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Dutch Safety Board 


The aim in the Netherlands is to limit the risk of accidents and incidents as much as 
possible. If accidents or near accidents nevertheless occur, a thorough investigation into 
the causes, irrespective of who are to blame, may help to prevent similar problems from 
occurring in the future. It is important to ensure that the investigation is carried out 
independently from the parties involved. This is why the Dutch Safety Board itself selects 


the issues it wishes to investigate, mindful of citizens’ position of dependence with (cane 
respect to authorities and businesses. In some cases the Dutch Safety Board is required 


by law to conduct an investigation. aa 
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On 17 July 2014, 298 people lost their lives when the Malaysia Airlines aeroplane they 
were in crashed near Hrabove, a village in the eastern part of Ukraine. The crash of flight 
MH17 caused the relatives of the occupants profound grief. There was also considerable 
dismay all over the world, especially when it became apparent that the aeroplane had 
presumably been shot down. The questions evoked by the crash were penetrating: Was 
the aeroplane actually shot out of the sky? Ana, if so, why was the aeroplane flying over 
an area where there was an on-going armed conflict? 


Four days after the crash, the United Nations Security Council unanimously adopted 
Resolution 2166, in which the Security Council expresses its support for an independent 
international aviation investigation into the crash. The Dutch Safety Board has investigated 
the causes of the MH17 crash and why the aeroplane was flying over the eastern part of 
Ukraine. This report contains the results of that investigation. The Board is aware that this 
does not answer one important question - the question of who is to blame for the crash. 
It is the task of the criminal investigation to provide that answer. 


International cooperation 

This investigation into the crash of flight MH17 was conducted by the Dutch Safety Board 
in accordance with the international regulations that apply to independent accident 
investigation, laid down in Annex 13 of the Convention on International Civil Aviation. 
Although it soon became clear that the crash of flight MH17 was probably no ‘ordinary’ 
aviation accident, this framework proved to be of great value to this investigation. It 
formed the basis for a constructive cooperation between the states involved in the 
investigation: the Netherlands, Ukraine, Malaysia, the United States, the United Kingdom, 
Australia and the Russian Federation. The representatives of these states, who were 
members of the international investigation team, had access to the investigation 
information and were able to study and verity it. 


This report contains the investigation’s facts, analysis, conclusions and recommendations. 
The Dutch Safety Board would like to highlight two themes, which transcend the 
investigated crash but which the Board believes could contribute to improving safety in 
international civil aviation. 


A blind spot in the risk assessment 

The crash involving flight MH17 makes it clear that in its risk assessments, the aviation 
sector should take more account of the changing world within which it operates. In this 
world armed conflicts are ongoing between governments on the one hand and one or 
more non-governmental groups on the other. As a rule, such conflicts are more disorderly 
and less predictable than ‘traditional’ wars between states. The existence and the spread 
of advanced weapon systems means that the parties involved in these conflicts may 


ie = y 4 7 ot 279 









Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 
7 Flying over 
Ukraine 


rela a = 
9 Assessing the 
aL « 


ai 
Recommendations 


16 
List of appendices 


possess these types of weapon systems and therefore are able to hit targets at great 
distances and altitudes. The aviation sector should take urgent measures to identity, 
assess and manage the risks associated with flying over conflict zones more effectively. 


Even though flying is a relatively safe form of transport, it still involves risks. Therefore, 
the civil aviation sector will always have to find a balance between safety and the price 
people are willing to pay for it. These considerations will have to be made as carefully as 
possible. It is therefore important that the sector innovates when estimating and 
assessing statistically improbable scenarios with a major impact. Risk assessments should 
not only focus on phenomena that have threatened civil aviation in the past but also 
devote attention to new and thus unfamiliar threats in a changing world. The challenge is 
to stimulate the imagination of the parties concerned in such a way that improbable 
scenarios are also at the forefront of their minds and receive sufficient attention. 


No conclusive system of responsibilities 

The system of responsibilities for civil aviation safety is not conclusive. In the system, 
states have sovereignty over their airspace and are responsible for operators being able 
to safely fly through that airsoace. However, the crash involving flight MH17 demonstrates 
that an unrestricted airspace is not, by definition, safe. In practice, states embroiled in an 
armed conflict rarely close their airsoace. Therefore, it is important that these states’ 
responsibility for closing parts of their airsoace above an armed conflict is formulated in 
a clearer and less non-committal manner. 


Since, in the case of flying over conflict zones, one cannot simply rely on an unrestricted 
airspace being safe, other parties in the system also bear a major responsibility: airline 
operators, other states and international organisations such as ICAO and IATA. They 
should form a second barrier, because the principle of sovereignty may give rise to 
vulnerabilities. It is up to the parties cited to jointly ensure that the decision-making 
process related to flight routes is improved. No single party can achieve this alone. It 
requires new structures for cooperation between states and operators, as well as for 
mutually sharing information, even if it is meant to be confidential. International 
organisations should facilitate these parties in developing these structures. 


The Dutch Safety Board is aware that there is no such thing as a perfect risk assessment, 
that a comprehensive system of responsibilities is impossible and that not all crashes and 
accidents can be prevented. There are, however, possibilities to improve civil aviation 
safety. The ball is now in the court of the states and the aviation sector. 
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The crash of flight MH17 raised many questions. What happened exactly? Why was the 
aeroplane flying across an area where an armed conflict was being fought? The Dutch 
Safety Board answers these questions in this report; it does not address questions of 
blame and liability. 


Causes of the crash 


On 17 July 2014, at 13.20' (15.20 CET) a Boeing 777-200 with the Malaysia Airlines 
nationality and registration mark 9M-MRD disappeared to the west of the TAMAK air 
navigation waypoint in Ukraine. A notification containing this information was sent by the 
Ukrainian National Bureau of Air Accident Investigation (NBAAI) on 18 July 2014, at 
approximately 06.00 (08.00 CET). The NBAAI was notified by the Ukrainian State Air 
Traffic Service Enterprise (UkKSATSE) that communication with flight MH17 had been lost. 
A signal trom the aeroplane’s Emergency Locator Transmitter had been received and its 
approximate position had been determined. 


The aeroplane impacted the ground in the eastern part of Ukraine. The wreckage was 
spread over several sites near the villages of Hrabove, Rozsypne and Petropavlivka. Six 
wreckage sites were identified, soread over about 50 km*. Most of the wreckage was 
located in three of these sites to the south-west of the village of Hrabove. This is about 
8.5 km east of the last known position of the aeroplane in flight. At two sites, post-impact 
fires had occurred. 


All 298 persons on board lost their lives. 


The in-flight disintegration of the aeroplane near the Ukrainian/Russian border was the 
result of the detonation of a warhead. The detonation occurred above the left hand side 
of the cockpit. The weapon used was a 9N314M-model warhead carried on the 9M38- 
series of missiles, as installed on the Buk surface-to-air missile system. 


Other scenarios that could have led to the disintegration of the aeroplane were 
considered, analysed and excluded based on the evidence available. 


The airworthy aeroplane was under control of Ukrainian air traffic control and was 
operated by a licensed and qualified flight crew. 





1 All times in this report, unless otherwise indicated are in UTC and Central European (Summer) Time (CET). CET in 
the summer is UTC +2. See Section 12 - Abbreviations and Definitions, for further explanation. 
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Flight route over conflict zone 


Flight MH17 was shot down over the eastern part of Ukraine, where an armed conflict 
broke out in April 2014. At first this conflict took place mainly on the ground, but as from 
the end of April 2014 it expanded into the airspace over the conflict zone: Ukrainian 
armed forces’ helicopters, transport aeroplanes and fighters were downed. 


On 14 July, the Ukrainian authorities reported that a military aeroplane, an Antonov An-26, 
had been shot down above the eastern part of Ukraine. On 17 July, the authorities 
announced that a Sukhoi Su-25 had been shot down over the area on 16 July. According 
to the authorities, both aircraft were shot down at an altitude that could only have been 
reached by powerful weapon systems. The weapon systems cited by the authorities, a 
medium-range surface-to-air missile or an air-to-air missile, could reach the cruising 
altitude of civil aeroplanes. Consequently they pose a threat to civil aviation. 


Although (Western) intelligence services, politicians and diplomats established the 
intensification of fighting in the eastern part of Ukraine, on the ground as well as in the 
air, it was not recognised that as a result there was an increased risk to civil aeroplanes 
flying over the conflict zone at cruising altitude. The focus was mainly on military activities, 
and the geopolitical consequences of the conflict. 


Ukraine's airspace management 

With regard to airsoace management Ukraine is responsible for the safety of aeroplanes 
in that airspace. On 6 June 2014, the airspace above the eastern part of Ukraine was 
restricted to civil aviation from the ground up to an altitude of 26,000 feet (FL260). This 
enabled military aeroplanes to fly at an altitude that was considered safe from attacks 
from the ground and eliminated the risk that they would encounter civil aeroplanes, 
which flew above FL260. The authorities automatically assumed that aeroplanes flying at 
a higher altitude than that considered safe for military aeroplanes, were also safe. 


On 14 July 2014, the Ukrainian authorities increased the upper limit of the restricted 
airspace imposed on civil aviation to an altitude of 32,000 feet (FL320). The exact under- 
lying reason for this decision remains unclear. 


The Ukrainian authorities did not consider closing the airspace over the eastern part of 
Ukraine to civil aviation completely. The statements made by the Ukrainian authorities on 
14 and 17 July 2014, related to the military aeroplanes being shot down, mentioned the 
use of weapon systems that can reach the cruising altitude of civil aeroplanes. In the 
judgment of the Dutch Safety Board, these statements provided sufficient reason for 
closing the airspace over the conflict zone as a precaution. 


Choice of flight route by Malaysia Airlines and other airlines 

Malaysia Airlines assumed that the unrestricted airspace over Ukraine was safe. The 
situation in the eastern part of Ukraine did not constitute a reason for reconsidering the 
route. The operator stated that it did not possess any information that flight MH17, or 
other flights, faced any danger when flying over Ukraine. 
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Not only Malaysia Airlines, but almost all airlines that used routes over the conflict zone 
continued to do so during the period in which the armed conflict was expanding into the 
airspace. On the day of the crash alone, 160 flights were conducted above the eastern 
part of Ukraine - until the airspace was closed. 


Other states and the state of departure (the Netherlands) 

The Chicago Convention provides states with the option of imposing a flight prohibition 
or restrictions on airlines and issuing recommendations related to the use of foreign 
airspace. Some states, such as the United States, the United Kingdom, France and 
Germany, use this option with regard to their resident airlines. Although flight MH17 took 
otf from Dutch soil the Netherlands did not bear any formal responsibility for the flight, 
because it concerned a non-Dutch airline. The fact that Malaysia Airlines was operating 
the flight as KLM’s code share partner did not provide any legal authority either. 


During the period in which the conflict in the eastern part of Ukraine expanded into the 
airspace over the conflict zone, from the end of April 2014 up to the crash of flight MH17, 
not a single state or international organisation explicitly warned of any risks to civil 
aviation and not a single state prohibited its airlines or airmen from using the airspace 
over the area or imposed other restrictions. 


At the Dutch Safety Board's request, the Dutch Review Committee for the Intelligence 
and Security Services (CTIVD) examined whether the Dutch intelligence and security 
services possessed any information that could have been important for the safety of 
flight MH17. The services had no indication that the warring factions intended to shoot 
down civil aeroplanes. The services did not have any information that the groups that 
were fighting against the Ukrainian government in the eastern part of Ukraine possessed 
medium or long-range surface-to-air missiles. 


Possibilities for improvement 

The crash of MH17 demonstrates than an unrestricted airspace is not, by definition, safe 
if the state managing that airspace is dealing with an armed conflict. The reality is that 
states involved in an armed conflict rarely close their airspace. This means that the 
principle of sovereignty related to airsoace management can give rise to vulnerability. In 
the Board's opinion, states involved in armed conflicts should give more consideration to 
closing their airspace as a precaution. More effective incentives are needed to encourage 
them to do so. 


Airline operators may not assume in advance that an unrestricted airspace above a 
conflict zone is safe. The fundamental principle currently adopted by operators is that 
they use the airspace, unless doing so is demonstrably unsafe. In their risk analyses, 
operators should take greater account of uncertainties and risk-increasing factors, such 
as when a conflict expands into the airspace. The current regulations do not stipulate 
that operators shall assess the risks involved in overflying conflict areas. 


Operators themselves should gather more intormation to be able to perform an adequate 
risk assessment. This information can largely be acquired by consulting open sources, 
but in the case of conflict zones operators also need confidential information from states 
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with intelligence capabilities. Vital in this respect is the sharing of information between 
states, between states and operators and between operators. 


Not only the gathering of information, but also combining information in the fields of 
safety and security, as well as on developments on the ground and in the air proves 
important. In this regard, international regulations (the Chicago Convention) are currently 
too divided across these different fields. It was established that there are gaps between 
the various responsibilities, for which a solution should be found. 


Recommendations 


Level 1: Airspace management in conflict zones 
To ICAO: 


1. Incorporate in Standards that states dealing with an armed conflict in their territory 
shall at an early stage publish information that is as specific as possible regarding the 
nature and extent of threats of that conflict and its consequences for civil aviation. 
Provide clear definitions of relevant terms, such as conflict zone and armed conflict. 


2. Ask states dealing with an armed conflict for additional information if published 
aeronautical or other publications give cause to do so; offer assistance and consider 
issuing a State Letter if, in the opinion of ICAO, states do not sufficiently fulfil their 
responsibility for the safety of the airspace for civil aviation. 


3. Update Standards and Recommended Practices related to the consequences of 
armed conflicts for civil aviation, and convert the relevant Recommended Practices 
into Standards as much as possible so that states will be able to take unambiguous 
measures if the safety of civil aviation may be at issue. 


To ICAO Member States: 


4. Ensure that states’ responsibilities related to the safety of their airspace are stricter 
defined in the Chicago Convention and the underlying Standards and Recommended 
Practices, so that it is clear in which cases the airspace should be closed. 


The states most closely involved in the investigation into the crash of flight MH17 
could initiate this. 


Level 2: Risk assessment 
To ICAO and IATA: 


5. Encourage states and operators who have relevant information about threats within a 
foreign airspace to make this available in a timely manner to others who have an 
interest in it in connection with aviation safety. Ensure that the relevant paragraphs in 
the ICAO Annexes concerned are extended and made more strict. 
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To 


To 


ICAO: 


Amend relevant Standards so that risk assessments shall also cover threats to civil 
aviation in the airspace at cruising level, especially when overflying conflict zones. Risk 
increasing and uncertain factors need to be included in these risk assessments in 
accordance with the proposals made by the ICAO Working Group on Threat and Risk. 


IATA: 


Ensure that the Standards regarding risk assessments are also reflected in the IATA 
Operational Safety Audits (IOSA). 


To states (State of Operator): 


8. 


Ensure that airline operators are required through national regulations to make risk 
assessments of overflying conflict zones. Risk increasing and uncertain factors need 
to be included in these assessments in accordance with the proposals made by the 
ICAO Working Group on Threat and Risk. 


To ICAO and IATA: 


In addition to actions already taken, such as the website (ICAO Conflict Zone 
Information Repository) with notifications about conflict zones, a platform for 
exchanging experiences and good practices regarding assessing the risks related to 
the overflying of conflict zones is to be initiated. 


Level 3: Operator accountability 


To IATA: 


10, 


Ensure that IATA member airlines agree on how to publish clear information to 
potential passengers about flight routes over conflict zones and on making operators 
accountable for that information. 


To operators: 


lide 


Provide public accountability for flight routes chosen, at least once a year. 


In Section 11 the recommendations are described in more detail. 
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This report contains the product of the investigation that was conducted by the Dutch 
Safety Board and its international partners into the crash of flight MH17 on 17 July 2014. 
The report consists of two parts. The first part focuses on the causes of the crash. The 
second part addresses the flight route of flight MH17 on July 17 2014, and the decision- 
making processes regarding flying over conflict areas. 


1.1. The investigation 


Following the crash of Malaysia Airlines flight MH17 near the village of Hrabove (in the 
eastern part of Ukraine), the Ukrainian authorities initiated an investigation into the accident, 
in accordance with ICAO Annex 13. During the first days of the investigation, the Ukrainian 
authorities requested the Netherlands, the state with the largest number of nationals on 
board the aeroplane, to take over the investigation. The Netherlands granted the request 
made by the Ukrainian authorities. On 23 July 2014, Ukraine delegated the investigation to 
the Netherlands. Following the provisions of ICAO Annex 13, from that date the Netherlands 
was the State conducting the investigation. As the accident investigation authority of the 
Netherlands, the Dutch Safety Board was tasked to conduct the investigation. 


A tew days before, on 18 July 2014, the Dutch Safety Board had already launched an 
investigation into the decision-making related to flying over conflict zones, because 
questions were raised over whether civil airline operators should have been flying over 
the eastern part of Ukraine, an area in which an armed conflict had been ongoing for 
several months. As the route of flight MH17 is one of the circumstances contributing to 
the crash of flight MH17, the Dutch Safety Board decided to combine the investigation 
into the causes of the crash with the already ongoing investigation into the decision- 
making related to flight routes, and to present the findings in one report. 


The investigation was performed in accordance with the provisions of Annex 13 - Aircraft 
Accident and Incident Investigation to the Convention of International Civil Aviation. The 
Standards and Recommended Practices in Annex 13 are prescribed for the conduct of 
civil aviation accident investigation. 


1.2 Purpose and scope of the investigation 
The purpose of this investigation was to establish the causes of the crash and the factors 


that contributed to the crash. On 21 July 2014, the United Nations Security Council 
unanimously adopted a resolution, concerning the crash of flight MH17.* The resolution 





2 UN Security Council, Resolution 2166 (2014), S/res2166 (2014), 21 July 2014. 
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expressed support for the ‘efforts to establish a full, thorough and independent 
international investigation into the incident in accordance with international civil aviation 
guidelines’ and called on all United Nations Member States ‘to provide any requested 
assistance to civil and criminal investigations’. 


This investigation had two objectives. Firstly, the Dutch Safety Board wanted to establish 
the causes of the crash and wished to inform the relatives of the crew and the passengers, 
other parties concerned, and those having a special interest in the circumstances of the 
crash and the investigation accordingly. Secondly, the Dutch Safety Board intended to 
initiate appropriate safety actions in order to minimise the chance of similar occurrences 
in the future. 


The investigation report provides a detailed description of the sequence of events of 
flight MH17 from the departure airport up to and including the ground impact. It 
describes and analyses how the flight was conducted, how the decisions related to the 
use of its airsoace were taken by Ukraine, how the decision related to flying over the 
eastern part of Ukraine were taken by Malaysia Airlines, and other airline operators, and 
how the decision-making pertaining to flying over conflict areas is generally made. 
Finally, it also addresses the role of the Netherlands, as the state of departure of flight 
MH17, and other states with regard to flying over conflict areas. 


The key questions are: 


e What caused the crash of flight MH17? 

e How and why were decisions made to use MH17’s flight route? 

e How is the decision-making process related to flying over conflict zones generally 
organised? 

e What lessons can be learned from the investigation to improve flight safety and 
security? 


In accordance with Annex 13, it is not the purpose of this investigation to apportion 
blame or liability. The sole objective of the Annex 13 investigation and the Final Report is 
the prevention of accidents and incidents. 


1.3. Investigation methodology and parties concerned 


The investigation was conducted by the Dutch Safety Board. In addition to investigators 
from the Dutch Satety Board, the states listed below participated in the investigation and 
appointed an Accredited Representative: 


e Ukraine (State of Occurrence); 

e Malaysia (State of the Operator and State of Registry); 

e United States of America (State of Design and Manufacture of the aeroplane); 
e United Kingdom (State of Design and Manufacture of the engines); 
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e Australia (State that provided information on request - photographs of aeroplane 
wreckage parts at the crash area), and 

e Russian Federation (State that provided information on request - radar and communi- 
cation data and information on weapon systems). 


In addition to the states mentioned above, other states also had a special interest in the 
investigation because they lost citizens in the crash. In accordance with paragraph 5.27 
of Annex 13, experts from the following states were invited to view the recovered 
wreckage parts: Belgium, Canada, Germany, Indonesia, Israel, Italy, New Zealand, 
the Philippines, and Vietnam. Some of these states were included because some 
passengers held multiple nationalities. 


In accordance with paragraph 6.3 of Annex 13, the Dutch Safety Board sent the draft 
Final Report to the Accredited Representatives of the states participating in the 
investigation, inviting their significant and substantiated comments. In addition, (sections 
of) the draft Final Report were sent to other parties involved in the investigation (see 
Appendices V and W). 


Simultaneously with this investigation report the Dutch Safety Board has published a 
separate document in which the investigation methodology used, and the choices that 
were made in the process are accounted for.” 


1.4 Wreckage recovery 


As the crash area was in an area of armed conflict, it was for a long time not safe for the 
investigators to travel to the crash area to perform an investigation and to recover the 
wreckage. The first opportunity that was deemed sufficiently safe was from 4 to 
22 November 2014, about four months after the crash. The second opportunity was trom 
20 to 28 March 2015 and the third opportunity from 19 April to 2 May 2015. These 
recovery missions were organised by the Dutch Ministry of Defence. At the crash area, 
assistance was provided by the Organisation for Security and Cooperation in Europe 
(OSCE), the State Emergency Service (SES), and local residents. 


Due to the limited time investigators had access to the wreckage area and because the 
wreckage was located in six sites soread out in an area of approximately 50 km/?, the 
Dutch Safety Board's first priority was to recover parts that were of specific importance 
to the investigation. The majority of the wreckage that was recovered from flight MH17 
was secured during the first recovery mission. In addition, some wreckage parts, 
recovered during the second and third recovery missions, were used during the 
investigation. 





3 Dutch Safety Board, MH17 - About the investigation, October 2015. 
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1.5 Preliminary report 


The Dutch Safety Board published a Preliminary Report on 9 September 2014. The findings 
published in the Preliminary Report are listed below: 


iP 


2. 





According to the information received from Malaysia Airlines the crew was properly 
licensed and had valid medical certificates to conduct the flight. 

According to the documents, the aircraft was in an airworthy condition at departure 
from Amsterdam Airport Schiphol. There were no known technical malfunctions. 


.No technical malfunctions or warnings in relation to the event flight were found on 


Flight Data Recorder data. 


. The engine parameters were consistent with normal operation during the eventtflight. 


No engine or aircraft system warnings or cautions were detected. 


.No aural alerts or warnings of aircraft system malfunctions were heard on the Cockpit 


Voice Recorder. The communication between the flight crew members gave no 
indication of any malfunction or emergency prior to the occurrence. 


.At the time of the occurrence, flight MH17 was flying at Flight Level 330 (FL330) (See 


Abbreviations and Definitions for explanation on Flight Level/FL) in unrestricted 
airspace of the Dnipropetrovsk (UKDV) Flight Information Region (FIR) in the eastern 
part of Ukraine. The aircraft flew on a constant heading, speed and altitude when the 
Flight Data Recording ended. Ukrainian State Air Traffic Service Enterprise (UkSATSE) 
had issued NOTAMs of restricted access to the airspace below FL320. 


. The last radio transmission by the flight crew began at 13.19:56 (15.19:56 CET) and 


ended at 13.19:59 (15.19:59 CET). 


. The last radio transmissions made by Dnipropetrovsk air traffic control centre to flight 


MH17 began at 13.20:00 (15.20:00 CET) and ended at 13.22:02 (15.22:02 CET). The 
crew of flight MH17 did not respond to these radio transmissions. 


. No distress messages were received by the air traffic control. 
. According to radar data, three commercial aircraft were in the same Control Area as 


flight MH17 at the time of the occurrence. All were under control of Dnipro Radar. At 
13.20 (15.20 CET) the distance between the closest aircraft and MH17 was 
approximately 30 km. 


. Damage observed on the forward fuselage and cockpit section of the aircraft appears 


to indicate that there were impacts from a large number of high-energy objects (See 
Section 12, Abbreviations and Definitions) from outside the aircraft. 


. The pattern of damage observed in the forward fuselage and cockpit section of the 


aircraft was not consistent with the damage that would be expected from any known 
failure mode of the aircraft, its engines or systems. 


. The fact that there were many pieces of aircraft structure distributed over a large 


area, indicated that the aircraft broke up in the air. 


. Based on the preliminary findings to date (9 September 2014), no indications of any 


technical or operational issues were found with the aircraft or crew prior to the ending 
of the CVR and FDR recording at 13.20:03 (15.20:03 CET). 


. The damage observed in the forward section of the aircraft appears to indicate that 


the aircraft was penetrated by a large number of high-energy objects from outside the 
aircraft. It is likely that this damage resulted in a loss of structural integrity of the 
aircraft, leading to an in-flight break-up. 
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The Preliminary Report stated that the findings were preliminary and that further work 
was required to be performed, in order to substantiate factual information regarding: 


e Analyses of data, including Cockpit Voice Recorder, Flight Data Recorder and other 
sources, recorded onboard the aeroplane; 

e Analyses of recorded air traffic control surveillance data; 

e Analysis of meteorological circumstances; 

e Forensic examination of wreckage recovered and possible foreign objects, if found; 

e Results of the pathological investigation; 

e Analyses of the in-flight break-up sequence; 

e Assessment of the operator's and State of Occurrence’s management of flight safety 
over a region of conflict or high security risk; 

e Any other aspects that are identitied during the investigation. 


On 10 September 2014, one day after the publication of the report, an amendment was 
made to the Dutch translation of the English report. On page 14, the following sentence 
was deleted: ‘De NOTAM met luchtruimbeperking was uitgevaardigd in reactie op het 
neerschieten van een Antonov 24 vliegtuig op 14 juli dat op een hoogte van FL210 vloog.' 
[translated: ‘The restricted area NOTAM was issued in response to the loss of an Antonov 
24 aeroplane that was shot down at FL210 on 14 July.’] The sentence was deleted because 
during this stage of the investigation it could not be established with complete certainty 
whether this information was accurate. When translating the original English report into 
Dutch, the relevant sentence was accidentally not removed. However, this did not affect 
the provisional conclusions in the preliminary report. 


1.6 Other investigations 


In addition to the investigation discussed above, several other investigations were 
initiated, both by the Dutch Safety Board and other organisations: 


e Dutch Safety Board investigations- The Dutch Safety Board initiated two other 
investigations related to the crash of flight MH17. One focused on the availability of 
passenger information following the crash of flight MH17. The other was aimed at 
answering the question whether or not the occupants of flight MH17 were aware of 
the crash, and how their remains were recovered. The findings trom the investigation 
into passenger information are published simultaneously in a separate report; the 
findings regarding awareness of occupants were published in this report. The 
investigation reports of the Dutch Safety Board were published simultaneously and 
are available on the Boara’s website. 

° Criminal investigation into flight MH17 - Parallel to and separately from the work of 
the Dutch Safety Board, the Joint Investigation Team is conducting a criminal 
investigation into the crash in order to gather evidence and to bring the perpetrators 
to justice. The Joint Investigation Team consists of police officers and public 
prosecutors from Australia, Belgium, Malaysia, the Netherlands, and Ukraine. It is 
being coordinated by the public prosecutor from the Netherlanas. 

e Victim identification investigation - The victims were transported from Ukraine to the 
Netherlands by the Royal Netherlands Air Force and Royal Australian Air Force. The 
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identification of all the victims took place at the Korporaal van Oudheusden barracks 
in Hilversum. The identification was carried out by a team of 120 forensic specialists. 
In addition to the National Forensic Investigation Team of the Netherlands (LTFO), 
80 forensic specialists from Australia, Belgium, Germany, United Kingdom, Indonesia, 
Malaysia and New Zealand participated. 


1.7. Reading guide 
The report is divided into: 


e Part A: containing the findings of the investigation into the causes of the crash of the 
aeroplane. 

e Part B: containing the findings of the investigation into flying over conflict areas. 

e The conclusions and recommendations made as a result of the investigation. 


Part A contains a record of the facts and circumstances established in the investigation: 
the sequence of events, flight crew qualifications, aeroplane information, flight recorders, 
air traffic services and radars, weather, flight route information, the wreckage, medical 
and pathological information, and tests and research. Following the factual material, the 
significance of the relevant facts and circumstances presented are analysed, in order to 
determine which events contributed to the crash. The analysis is primarily divided into six 
subjects: 


1. General matters, including the flight crew’s qualifications and the airworthiness of the 
aeroplane; 

2. The flight before the in-flight break-up, including pre-flight planning, weather 

considerations and flight operations; 

The moment of the in-flight break-up; 

The in-flight break-up, its aftermath, and causes of the crash; 

Survival aspects; 


Soe oS 


The recording of radar surveillance data. 


Part B concerns the decision-making process related to flight MH17. This part contains 
six sections: 


1. Adescription of the system of responsibilities of parties involved; 

2. Indicators related to the situation in the eastern part of Ukraine in the months prior to 
the crash of flight MH17; 

3. The airspace management by Ukraine in the period up to and including 17 July 2014; 

4. The route and flight operations of flight MH17, the decisions made by the airline, 
Malaysia Airlines, and the decisions made by other airlines and other states with 
regard to flying over the conflict area in the eastern part of Ukraine; 

5. The role of the Netherlands, as the state of departure of flight MH17, with regard to 
flying over conflict areas; 

6. Risk assessment related to flying over conflict zones. 


Each of these sections contains both findings and analysis. 
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The appendices that were produced as a part of this report are either published separately 


in an appendix to this report or on the Dutch Safety Board's website: www.safetyboard.nl. 


Section 13 gives an overview of the appendices. 
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PART A: 
Causes of the crash 


This part of the report focuses on the causes of 
the crash of Malaysia Airlines Boeing 777-200, 
9M-MRD, flight MH17 on 17 July 2014. 
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2.1 History of the flight 


On 17 July 2014, the day of the crash, the subject aeroplane, a Malaysia Airlines Boeing 
777-200 with nationality and registration marks 9M-MRD, had arrived at its gate at 
Amsterdam Airport Schiphol (hereafter, Schiphol) in the Netherlands at 04.36 (06.36 CET) 
from Kuala Lumpur International Airport (hereafter, Kuala Lumpur) in Malaysia. 


At 10.13 (12.13 CET), after having been serviced and prepared for flight, the aeroplane 
left gate G3, thirteen minutes later than planned, primarily due to overbooking and the 
late arrival of some transfer passengers, on a scheduled passenger flight to Kuala Lumpur 
with flight number MH17. 


Malaysia Airlines had prepared and filed an air traffic control flight plan. The flight crew 
was provided by the ground handling agent with an operational flight plan, NOTAMs,* 
load information and weather information prior to departure. The material had been 
prepared in Kuala Lumpur by Malaysia Airlines. The operational flight plan contained 
detailed route information, a summary of the mass data, fuel information and information 
on the winds and temperatures along the route. It was standard practice for the flight 
crew to study the material provided in order to adjust the fuel load or route planned if 
the pilot in command deemed this necessary. 


There were 298 persons, including 283 passengers on board the aeroplane. The crew 
was composed of four flight crew members and 11 cabin crew members. 


The aeroplane took off from Schiphol on runway 36C at 10.31 (12.31 CET). The aeroplane 
flew to the north of Amsterdam, and followed standard instrument departure route 
NYKER 3W to a south-easterly direction towards Germany. The aeroplane climbed in a 
series of steps to FL250 before crossing the Dutch/German border at air navigation 
waypoint SONEB. From SONEB the route continued south-east towards Poland. The 
aeroplane then continued, in accordance with the air traffic control flight plan, across 
Poland. After passing overhead Warsaw, the flight continued into Ukrainian airspace. 


The flight was planned to initially cruise at FL310, climbing to FL330 in Polish airspace 
and climbing further to FL350 when passing air navigation waypoint PEKIT in Ukrainian 
airspace. After having crossed Ukrainian airspace, the flight was planned to continue over 
the Russian Federation towards the Caspian Sea, over north-east Iran, Afghanistan and 
Pakistan before passing overhead Delhi, India and then crossing the Bay of Bengal 





4 A notice distributed by means of telecommunication containing information concerning the establishment, 
condition or change in any aeronautical facility, service, procedure or hazard, the timely knowledge of which is 
essential to personnel concerned with flight operations. 
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towards Thailand before turning south towards Kuala Lumpur in Malaysia. The flight 
would remain at FL350 until Thai airsoace when a climb to FL370 would be made before 
the top of descent prior to the landing at Kuala Lumpur (see Figure 1) after a flight of 
approximately eleven and a half hours. 


In the air traffic control flight plan (see Appendix C), a climb on airway L980 from FL330 
to FL350 was planned for at air navigation waypoint PEKIT. It was noted that the airline’s 
operational flight plan called for the climb from FL330 to FL350 to be made at air 
navigation waypoint EDIMI, 74 NM before PEKIT. The reason for having planned two 


different positions to climb in the two flight plans is explained in paragraph 3.3.2.1. 
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Figure 1: Diagram of the route planned. (Source: Google, INEGI) 


According to data from the Ukrainian State Air Traffic Service Enterprise, the aeroplane 
was flying at FL330 and, at about 12.53 (14.53 CET), entered Dnipropetrovsk Radar 
Control (Dnipro Radar) Sector 2 of the Dnipropetrovsk (UKDV) Flight Information Region 
(FIR). Dnipro Radar Sector 2 is a part of Ukrainian airspace. Figure 2 shows the details of 
the airspace structure in Ukraine. 
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Figure 2: Ukrainian FIRs and Sectors in UKDV FIR. (Source: Google, Landsat) 


On establishing initial contact with the flight crew, at 12.53 (14.53 CET) and at a position 
about 6 NM before PEKIT, Dnipro Radar asked whether the aeroplane could climb to 
FL350 in accordance with the air traffic control flight plan. The flight crew responded, 
without providing a specific reason (see Table 1 for an extract of the air traffic control 
transcript), that they were unable to comply with the request and requested to remain at 
FL330. This matter is discussed and analysed in paragraph 3.3.2.1. 


ATC to MH17 Malaysian one seven, Dnipro Radar, hello, identified, advise ... able to climb 
flight level three five zero? 


MH17 to ATC Malaysian one seven, negative, maintain three three zero 


ATC to MH17 Malaysian one seven, roger 





Table 1: Extract from Air Traffic Control (ATC) transcript. (See Appendix G fora full transcript of the communications) 


Dnipro Radar had identified a potential loss of separation between flight MH17 and another 
Boeing 777 aeroplane also flying at FL330 approaching flight MH17 trom behind. In order 
to solve the potential conflict, Dnipro Radar cleared the other traffic to climb to FL350. 


At 13.00 (15.00 CET), at a position about 40 NM after waypoint PEKIT, the flight crew of 
MH17 made a request to Dnipro Radar to change their track by turning to the left and 
deviating 20 NM north, in order to avoid the weather associated with the cumulonimbus 
clouds on the aeroplane’s track. The flight crew also inquired whether FL340 was 
available. Dnipro Radar cleared the aeroplane to deviate around the weather as requested, 
but instructed the aeroplane to remain at FL330 due to conflicting civil aviation. 
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Flight Data Recorder and radar data both show that after deviating from the route to the 
left by about 6.5 NM (laterally from the centreline of the original track), the aeroplane 
turned back towards airway L980 centreline at 13.05 (15.05 CET). 


Two minutes later at 13.07 (15.07 CET), Sector 2 of Dnipropetrovsk Area Control Centre 
transferred the flight to Sector 4 of Dnipropetrovsk Area Control Centre, a sector that 
also uses the callsign Dnipro Radar. 


After a further slight turn to the right at 13.15 (15.15 CET), radar data showed that at 13.19 
(15.19 CET) the aeroplane was at a position 3.6 NM north of the centreline of airway L980, 
almost back on its original course, between air navigation waypoint GANRA and waypoint 
TAMAK. From this point, Dnipro Radar cleared the aeroplane to fly directly to air navigation 
waypoint RND, about 45 NM south-east of TAMAK and south of the planned airway. The 
boundary between Ukrainian and Russian Federation airspace on the airway is at air 
navigation waypoint TAMAK. Figure 3 shows the route flown by MH17 across the eastern 
part of Ukraine and the planned route into Russian Federation airspace. 
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Figure 3: Route of flight MH17 across the eastern part of Ukraine. The light grey shading shows the area that 
is 5 NM left and right of the centreline of airway L980. The black line shows flight MH17 deviating 
from airway L980 between air navigation waypoints PEKIT and TAGAN. (Source: Google, Landstat) 


The clearance direct to air navigation waypoint RND was acknowledged by the flight crew 
at 13.19:56 (15.19:56 CET). This was the last radio transmission from flight MH17. Dnipro 
Radar immediately, at 13.20:00 (15.20:00 CET), advised flight MH17 to proceed to expect 
a clearance direct to waypoint TIKNA after RND. TIKNA is an air navigation waypoint in 
the Russian Federation located on airway A87. According to the air traffic control flight 
plan, flight MH17 had planned to use airway A87 after crossing the Ukrainian/Russian 
Federation border. No acknowledgement or further radio communication from flight 
MH17 was received. 


The aeroplane impacted the ground near the village of Hrabove in the eastern part of 
Ukraine. The moment of impact could not be determined exactly. However, in various 
articles and video’s from the media, local habitants described parts of the aeroplane 
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falling from the sky and some wreckage and human remains impacted houses and 
gardens at about 16.30 local time (15.30 CET). Wreckage parts of the aeroplane were 
spread over a number of sites, also near the villages of Rozsypne and Petropavlivka. 


Wreckage was identified within six different sites soread over an area of about 50 km‘. 
The majority of the wreckage was located in three sites (see paragraph 2.12.2) south- 
west of Hrabove. These three sites were located about 8.5 km on a bearing of 080° from 
the last known position of the aeroplane in flight. At two of these sites, post-impact fires 
had occurred. 


2.2 Injuries to persons 





Fatal 4 11 233° 0 270 
Serious 0 0 0 0 0 
Minor/None 0 0 0 0 0 
Total 4 11 283 0 276 








Table 2: Injury chart. 


The occupants of the aeroplane were citizens of the following states: 


Netherlands es Belgium 4 
Malaysia 43 Philippines 3 
Australia 27 Canada 1 
Indonesia ie New Zealand 1 
United Kingdom 10 

Germany 4 Total 298 


The nationalities indicated above reflect the information provided by the operator, based 
on the passports that were used for check-in. 24 passengers had multiple nationalities 
resulting in differences in nationality numbers published by other sources. These 
nationalities were Australia, Belgium, Germany, Indonesia, Israel, Italy, Malaysia, the 
Netherlands, United Kingdom, United States and Vietnam. Further information on the 
nationalities of the occupants is included in the MH17 Passenger Information report. 


No reports were received regarding injuries or fatalities to persons on the ground as a 
result of the crash. 





a Includes three infants who had not reached the age of 2 years. 
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2.3 Damage to the aircraft 


The aeroplane was destroyed. 


2.4 Other damage 


Damage was caused to houses, buildings, parts of the infrastructure and agricultural 
ground as a result of a combination of the aeroplane wreckage, human remains, cargo 
and baggage falling on the ground and the post-crash fire. This information was obtained 
via photos taken by the investigators and police, as well as media information and 
material published on the internet. 


2.5 Personnel information 
2.5.1 Flight crew 


The flight crew consisted of two Captains and two First Officers, all of whom were fully 
qualitied to operate a Boeing 777-200. Further details are recorded in Table 3. 





Captain (Team A) License 
Malaysian nationality 


Airline Transport Pilot Licence 








777 type rating Valid to: 31 October 2014 
male, age 44 
Base check Valid to: 29 October 2014 
Line check Valid to: 31 October 2014 
Medical certificate Class 1 
Valid to: 31 October 2014 
Flying experience Total: 12,385.57 hours 
777-200: 7,303.15 hours 
Last 90 days: 116.02 hours 
Last 30 days: 34.54 hours 
Last 24 hours: 0.0 hours 
First Officer (Team A) License Airline Transport Pilot Licence 
Dye easy 777 type rating Valid to: 31 March 2015 
male, age 26 
Base check Valid to: 13 December 2014 
Line check Valid to: 28 February 2015 
Medical certificate Class 1 
Valid to: 31 March 2015 
Flying experience Total: 4,058.49 hours 
777-200: 296.22 hours 
Last 90 days: 117.58 hours 
Last 30 days: 40.13 hours 
Last 24 hours: 0.0 hours 
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Flight crew member 


Captain (Team B) 
Malaysian nationality 
male, age 49 


First Officer (Team B) 
Malaysian nationality 


License 

7/7 type rating 
Base check 
Line check 


Medical certificate 


Flying experience 


License 


Airline Transport Pilot Licence 


Valid to: 31 October 2014 
Valid to: 20 August 2014 
Valid to: 30 November 2014 
Class 1 

Valid to: 31 October 2014 
Total: 13,239.08 hours 
777-200: 7,989.14 hours 
Last 90 days: 152.31 hours 
Last 30 days: 62.21 hours 
Last 24 hours: 0.0 hours 


Airline Transport Pilot Licence 


777 type rating Valid to: 30 November 2014 
male, age 29 
Base check Valid to: 6 January 2015 
Line check Valid to: 31 March 2015 
Medical certificate Class 1 
Valid to: 30 November 2014 
Flying experience Total: 3,190.12 hours 
777-200: 227.48 hours 
Last 90 days: 138.14 hours 
Last 30 days: 28.24 hours 
Last 24 hours: 0.0 hours 








Table 3: Flight crew information. 


The operator’s Operations Manual Part A sets out procedures to meet the applicable 
flight time limitations regulations. For a flight of around 12 hours, four pilots, two of 
whom are Captains, are required. On flight MH17, two captains and two First Officers 
were scheduled to operate the flight in two teams; Team A and Team B. Team A flew the 
first part of the flight and were at the controls at the time of the crash, the Captain in the 
left pilot seat and the First Officer in the right pilot seat. When not acting as pilots, it is 
common practice for the other flight crew members (Team B, in this case) to rest in the 
bunks that are located behind the cockpit, in a seat in business class or to occupy the 
observer seats in the cockpit. 


2.5.2 Cabin crew 

There were eleven cabin crew members. The investigation did not consider cabin crew 
training and qualification relevant for the investigation into the causes of the crash. 
Hence, the cabin crew records were not reviewed and analysed. 


Summary of the crew information 
According to the documents and information received from Malaysia Airlines the 


flight crew was properly licensed to conduct the flight. The flight crew consisted of 
two Captains, two First Officers and eleven cabin crew members. 
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2.6 Aircraft information 
This Section and Appendix J provide information on the following: 


e Ageneral description of the aeroplane involved in the crash; 

e Adescription of the operation, airworthiness and maintenance of the aeroplane and 
specific systems and equipment that are deemed relevant to the investigation, and 

e The load of the aeroplane. 


2.6.1 General description 

The aeroplane, a Boeing 777-200, is a low-wing, wide body, commercial aeroplane fitted 
with two wing-mounted turbofan engines and a tricycle landing gear configuration. The 
aeroplane’s maximum take-off mass was 286,897 kg. The passenger seating configuration 
for 9M-MRD was 33 business class seats located in the front of the cabin and 247 economy 
class seats. The aeroplane had accumulated 76,322 flight hours and 11,434 cycles (see 
Section 12 - Abbreviations and Definitions). The aeroplane was equipped with two Rolls- 
Royce Trent-892B series engines. 


The most recent version of the certificate of registration of 9M-MRD, issued by the 
Department of Civil Aviation Malaysia, in accordance with Malaysia Civil Aviation 
Regulations 1996, was dated 23 August 2006. The Department of Civil Aviation Malaysia 
issued a certificate of airworthiness numbered M.0817 for 9M-MRD (serial number 28411) 
on 7 July 2014 that replaced the certificate previously issued on 8 July 2013. The new 
certificate was valid until 29 July 2015. 


The scheduled maintenance, implementation of mandatory modifications and the 
treatment of defect reports were analysed. Details on this and other airworthiness related 
issues at Malaysia Airlines are provided in Appendix J. 


2.6.2 Aeroplane load and technical defects 
According to the load sheet, the aeroplane was loaded as follows: 





Load sheet data 


Checked baggage and cargo: 17,751: ko 
Passengers and hand-baggage (based on standard masses): 20,225 kg 
Aeroplane - empty mass: 145,015 kg 





The aeroplane’s balance figures were: 


Percentage mean aerodynamic chord (MAC): 25.51 


Loaded index: 35.47 


Table 4: Load data. 
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The actual take-off mass of the aeroplane was 278,691 kg° and the forward and aft limits 
of the centre of gravity at the take-off mass were 21 and 38.5 percent MAC, respectively. 
The take-off mass and the load were within authorised limits. 


The 17,751 kg baggage and cargo load was distributed in the under-floor cargo 
compartments as shown in Appendix E. 


The NOTOC (see Section 12 - Abbreviations and Definitions and Appendix E) produced 
for the flight crew by the ground handling agent showed that the loaded cargo did not 
contain any dangerous goods. The NOTOC recorded medical supplies, cut flowers and 
animals as being on board and classitied as Special Load. 


A review of the cargo manifest showed no evidence of any goods that should have been 
classified as dangerous goods; e.g. chemicals, vehicle engines, etc. It was noted that a 
single lithium-ion battery was included on the cargo manifest. This item was declared as 
properly packaged and was therefore exempted from being classified as dangerous 
goods. As such, this small item was not considered relevant to the investigation. 


The technical log entry made prior to departure from Schiphol shows that the fuel 
quantity in the aeroplane was 96,500 kg of which 9,800 kg remained from the previous 
flight. This is 800 kg more than was required for the planned take-off tuel of 95,700 kg. 
Prior to flight MH17, engine oil was added to the left engine. The technical log was signed 
by the line engineer and the captain of flight MH17, confirming that the required 
maintenance checks had been conducted. 


Three deficiencies were open as deferred items on flight MH17. These were: 


e Cockpit Voice Recorder area microphone cap in the cockpit was missing; 

e Acomment about the condition of two cabin overhead bins; 

e The left engine acoustic lining was damaged. The area of the damage was 
approximately 2 x 6 centimetres. 


Summary of aircraft information 


e According to the documents and information received, the aeroplane was in an 
airworthy condition on departure from Schiphol, with three technical defects 
documented. 

e The flight documents also showed that the aeroplane was prepared for departure 
from Schiphol with a load of 283 passengers, 17,751 kg of checked baggage and 
cargo and 96,500 kg of fuel. An air traffic control flight plan had been filed. The 
flight crew had been provided with an operational flight plan, NOTAMs, loading 
and weather information. 

e The mass and the centre of gravity of the aeroplane were within authorised limits. 





6 The take-off mass excludes 800 kg of fuel that was used during taxiing. 
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2.7. Meteorological information 


2.7.1. General 
The weather conditions described in this paragraph were obtained from three 
meteorological institutes: 


e Royal Dutch Meteorological Institute (KNMI); 
e British Met Office; 
e Ukrainian Hydrometeorological Institute. 


2.7.2 Forecast weather 
The meteorological reports (METARs) for the airports in the vicinity, and at about the 
time of the crash (times in UTC only), show the following information: 


Explanation of relevant information Airport name (ICAO code) 


Se AN 





Information issued: 17 July, 13.30; Kryvyi Righ (UKDR) 
Wind: mainly from direction 050° and variable between 020° and 090°, 
speed 6 m/s; 171330Z O5006MPS 


O20V090 CAVOK 25/16 
Q1011 3609//70 NOSIG 


Cloud and visibility: CAVOK;’ 

Temperature: 25 °C, dew point 16 °C; 
Barometric pressure at sea level: 1,011 hPa, and 
No significant change expected. 


Information issued: 17 July, 13.30; Dnipropetrovsk (UKDD) 


Wind: mainly from direction 060°, speed 5 m/s; 


Cloud and visibility: visibility more than 10 km, thunderstorms in the 171330Z O6005MPS 9999 
vicinity, scattered cumulonimbus cloud coverage at 3,300 feet, broken at =VCTS SCT033CB BKN100 
10,000 ft; 25/18 Q1011 08210270 


Temperature: 25 °C, dew point 18 °C; TEMPO 05008G14MPS 
Barometric pressure at sea level: 1,011 hPa, and; TSRA BKNO15CB 
Expected change: temporarily in the coming 60 minutes, wind direction 
050° and wind speed 8 m/s with gusts of 14 m/s, thunderstorms and rain 
and cloud coverage: cumulonimbus clouds broken at 1,500 feet. 


Information issued: 17 July, 13.30; Kharkiv (UKHH) 
Wind: mainly from direction 070°, speed 4 m/s; 
Cloud and visibility: visibility more than 10 km, scattered cumulonimbus — 171330 07004MPS 9999 
cloud coverage at 3,300 ft, broken cloud coverage at 20,000 ft; SCTO033CB BKN200 31/11 
Temperature: 31 °C, dew point 11 °C; Q1013 070/// 65 TEMPO 
Barometric pressure at sea level: 1,013 hPa, and O8009G16MPS 

Expected change: temporarily in the coming 60 minutes, wind direction 
080°, wind speed 9 m/s with gusts of 16 m/s. 








7 CAVOK stands for “Ceiling and Visibility OK"; specifically, (1) there are no clouds below 5,000 feet above 
aerodrome level or minimum sector altitude (whichever is higher) and no cumulonimbus or towering cumulus; (2) 
visibility is at least 10 kilometres or more, and (3) no current or forecast significant weather such as precipitation, 
thunderstorms, shallow fog or low drifting snow. 
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Explanation of relevant information Airport name (ICAO code) 
METAR 





Information issued: 17 July, 13.30; Kyiv Boryspil (UKBB) 
Wind: direction 030°, speed 7 m/s; 
Cloud and visibility: CAVOK; 171330 03007MPS CAVOK 
Temperature: 30 °C, dew point 16 °C; 30/16 Q1015 88CLRD9I5 
Barometric pressure at sea level: 1,015 hPa; NOSIG 

Runway clear of contamination and braking action is good, and 
Expected change: no significant change. 





Table 5: METARs in force on 17 July 2014. 


On 17 July two SIGMET® messages for the Dnipropetrovsk Flight Information Region 
were published. The second SIGMET, number 5, superseded the first. The SIGMETs (with 
times in UTC only) contain the following information: 


Plain language explanation SIGMET 





SIGMET 4 for the UKDV FIR UKDV SIGMET 4 

Validity: 17 July between 09.00 and 12.00; VALID 170900/171200 UKDV 
Forecast: Embedded thunderstorms with large hail stones - UKLDV DNJEPROPETROVSK FIR 
forecast over the whole Dnipropetrovsk region, with cloud EMBD TSGR FCST OVER WHOLE 
tops between 34,000 and 39,000 feet moving North with DNJEPROPETROVSK FIR 

a speed of 20 km/h, and TOP FL340/390 MOV N 20 KM/H NC 
Expected change: No change. 


SIGMET 5 for the UKDV FIR UKDV SIGMET 5 

Validity: 17 July between 12.00 and 15.00; VALID 171200/171500 UKDV 

Forecast: Embedded thunderstorms with large hail stones UKDV DNJEPROPETROVSK FIR EMBD 
forecast over the whole Dnipropetrovsk region, with cloud TSGRFCST OVER WHOLE 

tops between 37,000 and 41,000 ft, moving North with a DNJEPROPETROVSK FIR 

speed of 15 km/h, and TOP FL370/410 MOV N 15 KM/H INTSF 
Expected change: intensifying. 





Table 6: SIGMETs in force on 17 July 2014. 


2.7.3. Weather information provided to flight crew 

Prior to departing from Schiphol, the flight crew received the most recent weather 
information from the ground handling agent during the flight preparation. The information 
provided was: 


e Prognostic weather charts for significant weather, valid on 17 July at 06.00, 12.00 and 
18.00 (08.00, 14.00 and 20.00 CET) on the route Amsterdam - Kuala Lumpur between 
FL250 and FL630; 

e The forecast wind direction, soeed and air temperature between Amsterdam and 
Kuala Lumpur from ground level to FL430 at different points along the planned route; 

e Forecast of turbulence and, if present, its severity at each air navigation waypoint on 
the route Amsterdam - Kuala Lumpur; 


8 ASIGMET contains information concerning en-route weather phenomena which may affect the safety of aircraft 
operations. 
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e The weather reports of large airports and Flight Information Regions on the route 
Amsterdam - Kuala Lumpur, including the METAR for Kyiv Boryspil Airport described 
above. 


The prognostic weather charts for significant weather showed an area with occasional 
embedded cumulonimbus clouds up to FL350 north-west of the Black Sea forecast to 
move north-east during the period of the forecast. 


The forecast wind and temperature in Ukraine at FL330 and FL350, as reported to the 
flight crew in the information provided by the ground handling agent prior to the flight, 
varied between 160 and 165 degrees/17 to 19 knots in Ukrainian airspace up to air 
navigation waypoint PEKIT, and between 180 and 220 degrees/20 to 40 knots between 
air navigation waypoint PEKIT and the border with the Russian Federation at air navigation 
waypoint TAMAK. The outside air temperature varied between -40 and -50 °C. 


2.7.4 Actual weather 
An aftercast was made of the general weather conditions in the area of Donetsk at about 
14.00 (16.00 CET) on 17 July 2014 by KNMI. 


A near stationary occlusion associated with an area of low pressure above the Black Sea 
extended from the Russian Federation and Ukraine to Romania. In between this 
depression and an anticyclone over north-western Europe, a weak north-easterly flow 
led warm and unstable continental air over the vicinity of the crash site. Several clouds, 
producing rain and thunderstorms, originated at different places in this system. The 
cloud base was between 3,000 and 5,000 feet with peaks, generally, at around FL350. 


Weather satellite images of Europe showed large cloud formations west and north of the 
Black Sea; an area largely matching with the Dnipropetrovsk Flight Information Region. 
The area to the south of flight MH17’s last known position contained mostly cumulonimbus 
clouds and possibly thunderstorms. The sky above areas associated with the 
cumulonimbus clouds was obscured with a cloud base of between 1,000 and 5,000 ft. In 
other places, the sky was less obscured. The weather system was moving to the north- 
east. See also Appendix F. 


Analysis of ground observations, showed that thunderstorms were reported in the area 
to the south, west and south-west of the crash area. The winds at ground level were 
north or north-easterly and tended to gradually veer with altitude, eventually becoming 
south-westerly by about FL230. From this point, the winds increased in speed with 
altitude towards the tropopause, indicated at being around FL400. The cloud cover is 
shown on a visible-light satellite image issued at 13.00 (15.00 CET). 
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Figure 4: Satellite image of weather and route overlaid on map of the eastern part of Ukraine. Note: the yellow 


cross was added by the meteorological institute to mark the geographic position 48°N 038° E. 


(Source: Google, TerraMetrics) 


Summary of the weather information 


The weather forecast indicated that the weather over the eastern part of Ukraine 
included thunderstorms. The actual weather was consistent with the forecast. 


2.8 Aids to navigation 


In addition to the NOTAMs described in paragraph 2.9.4 of this report, the flight crew's 
briefing package contained one company instruction that pertained to Ukrainian 
airspace. On 28 April 2014, Malaysia Airlines introduced briefing note MAS 00083/14 
regarding the possible loss of Global Positioning System (GPS) signals in Ukrainian 
airspace (See Appendix D). Flight Data Recorder data showed that the GPS reception 
was normal on flight MH17. 


2.9 Air Navigation Service Provider information and other data 


2.9.1 General 

This Section contains information regarding air traffic management in Ukraine and the 
Russian Federation. Information regarding the Russian Federation is included since flight 
MH17 was about to enter Russian Federation airspace. Following a short introduction 
about the Air Navigation Service Providers, radar data from both Air Navigation Service 
Providers and the communications between the air traffic controllers from Ukraine and the 
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Russian Federation are described. Lastly, information from Airborne Warning and Control 
System (AWACS) aeroplanes is described. Air traffic management, the airspace affected 
and associated restrictions are described in detail in Section 6 (part B) of this report. 


Licenses and qualifications of the air traffic controllers were not relevant to the 
investigation into the crash. The handling of the flight and the actions after radio contact 
with flight MH17 was lost, were considered adequate. 


2.9.2 Air traffic management 

Ukrainian State Air Traffic Service Enterprise (UkSATSE) is the air navigation service 
provider for civil aviation in Ukraine. Air traftic management in Ukraine is the responsibility 
of a two-party system, comprising the Ministry of Infrastructure and the Ministry of 
Defence. Civil and military air traffic management activities are coordinated by Integrated 
Civil Military Air Traffic Management System that functions as a part of UkSATSE. 


For the Russian Federation, civil and military air traffic management is the responsibility 
of the State Air Traffic Management Corporation (GKOVD). This is a government owned 
corporation (a so-called Federal State Unitary Enterprise) which is supervised by the 
Federal Agency for Air Transport (ROSAVIATSIA), which in turn comes under the Ministry 
of Transport. 


2.9.3 Airspace 

Ukrainian airspace is made up of five flight information regions and a network of airways 
for the purpose of provision of air traffic control service for en-route flights. Ukraine 
applies the ICAO system of flight levels. It was noted that due to the situation in Crimea, 
the Ukrainian authorities restricted the use of segments of the routes within Simteropol 
FIR from 3 April 2014. At the time of the crash, these restrictions, published in NOTAM 
number 0569/14, were in force. 


The adjacent sector in the Russian Federation to Dnipropetrovsk Control Sector 4 in 
Ukraine has the callsign Rostov Radar. 


For flights such as flight MH17, performed under instrument flight rules, the general 
principle of standard flight levels (FL) applies: odd thousands of feet (flight levels 310, 
330, 350) when on a magnetic track of O° through 179° and even thousands of feet (flight 
levels 300, 320, 340) when on a magnetic track of 180° through 359°. Other flight levels 
may be available from air traffic control. 


For flight MH17, following airway L980, through the Dnipropetrovsk (UKDV) FIR, on an 
eastbound track, odd number standard flight levels were in use, as depicted in its flight 
plan for this part of its routing: FL330 and FL350. The airway’s width is 10 NM (5 NM on 
either side of the centreline) and extends from FL280 to FL660 vertically. 


2.9.4 Airspace restrictions 

Both Ukraine and the Russian Federation had issued NOTAMs that restricted access to parts 
of their respective airspace up to FL320. On 17 July parts of the airspace in both countries 
were restricted up to FL320. At the time of the crash, flight MH17 was flying at FL330 in 
unrestricted airspace of the Dnipropetrovsk (UKDV) FIR in the eastern part of Ukraine. 
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2 Factual 
information 


Appendix D contains complete details of all NOTAMs in force at the time of the crash 
and provides a short explanation of the structure and content of the NOTAMs. In Part B 
of this report the airspace restrictions are described and discussed in more detail. 


Summary of the airspace information 


At the time of the occurrence, flight MH17 was flying at FL330 in unrestricted 
airspace of the Dnipropetrovsk (UKDV) FIR in the eastern part of Ukraine. 


2.9.5 Air traffic services surveillance data 


2.9.5.1 Introduction 
Ground-based data sources were available and obtained for the investigation. Recorded 
data from Ukrainian and Russian Federation radar stations was provided to the Dutch 


Safety Board. sichies 


Introduction to 
Part B 


Air traffic services surveillance data is, in general, obtained from three different sources: 


e Primary radar: a system that emits a series of radio waves in pulses that are reflected 
off moving targets. Target position and speed are determined by comparison of the 
transmitted and the reflected radio waves. 

: ‘ 1a oe 

e Secondary surveillance radar: a radar system that interrogates a transponder carried Be eT a 
in an aircraft to provide the air traffic controllers with information such as aircraft type, 
position, altitude, flight number and destination. This is known as Mode S. 

e Automatic Dependent Surveillance - Broadcast data: an aircraft-based technology 


whereby the aircraft broadcasts its position, altitude and speed to air traffic control. 


The data received by the sensors in the three systems is known as raw data. The raw data Part B: 
; . 7 Flying over 
is processed for display on a radar screen for use by air traffic control staff. The raw data Thee 


received by the radar sensors, the data processed for display and the actual displayed 
data can all be recorded and stored for analysis at a later date. The Standards and 
Recommended Practices in ICAO Annex 11 - Air Traffic Services, contain the requirements 
for recording and retaining such data. Table 7 summarises the standards for recording and 
retaining data in Annex 11. The recordings are to be retained for a minimum of 30 days. 


Part B: 


9 Assessing the 


Data link data between ATC and aircraft 6.2.2 
Data link data between ATC stations 


ATC computer data exchanged between ATC stations 


11 


Surveillance data (including primary and secondary data) shall be 6.4.1 Haar Gee err ae 


saved for incident and accident investigation, Search and Rescue 
and ATC system evaluation and training. 





Table 7: Summary of Annex 11 air traffic management data recording requirements. 
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A state that, for certain reasons, does not comply with an ICAO Standard is required to 
notify ICAO that a difference between their national regulations and the ICAO Standard 
exists. A review of the differences notified to ICAO by states showed that neither Ukraine 
nor the Russian Federation had notified to ICAO that their national regulations differed 
from the Standards promulgated in Annex 11. 


Surveillance data from the radar systems of both Ukraine and the Russian Federation was 
requested for the investigation. The data requested for the investigation was as follows: 


Primary radar data - raw data Not available Not available 
Primary radar data - processed data Not available Not available 
Secondary surveillance radar data - raw data | Available Not available 
Secondary surveillance radar data - Available Not available 


processed data 
ADS-B data Available Not available 


Video film of radar screen | Video film of radar screen 
showing processed showing processed primary 
secondary data and secondary data 


Other data made available 


Table 8: Radar data, requested and received. 


Appendix | contains various relevant stills from the videos provided by both UkSATSE 
and GKOVD. 


The reasons why data was not available are discussed in paragraph 2.9.5.3. 


On 23 July 2014 (before the MH17 investigation was delegated to the Netherlands), 
experts of the international group of investigators and a representative of NBAAI had an 
interview with UkSATSE experts. During the interview information from different sources 
was provided by UkSATSE. The transferring of Air Traffic Control (ATC) records, including 
video and audio records to the experts of the international group of investigators was 
laid down in a protocol. See Appendix M. The next day, the investigators transferred the 
information received from UkSATSE to the Dutch Safety Board. 


2.9.5.2 Surveillance radar data 


The radar data for flight MH17 received from both Air Navigation Service Providers, 
UkSATSE and GKOVD, is described in this paragraph. 


The Ukrainian civil primary radar stations in the area were not functioning at the time of 
the crash due to scheduled maintenance. The military primary radar stations were also 
not operational. The Ukrainian Ministry of Defence stated that this system was not 
operational, because there were no Ukrainian military aircraft in the sector through which 
flight MH17 flew. UkSATSE provided secondary surveillance radar data in raw data format 
and a video containing a replay of the radar screen. Figure 5 shows a sample image of 
the replay of the radar screen and an explanation of the data displayed. 
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Figure 5: Sample Ukrainian radar screen display. (Source: UkSATSE) 


The secondary surveillance radar symbol for flight MH17, showed the flight number 
‘MAS17', the flight level ‘330’ and aeroplane type ‘B772H’. The letter ‘H’ stands for 
‘heavy’; a term referring to the aeroplane’s wake-turbulence category. The word ‘TAMAK’ 
indicated the air navigation waypoint to which the aeroplane was cleared. The number 
‘491' indicated the aeroplane’s groundspeed in knots. The line displayed in brown was 
airway W633 with air navigation waypoint BELOL displayea. 


The data did not contain any failures, emergency codes or other alerts from flight MH17. 


The raw data for the last received message and the last target data information trom 
flight MH17 both have a time stamp of 13.20:03 (15.20:03 CET). The processed data 
showed that no Mode S data was displayed from 13.20:18 (15.20:18 CET) and the coasting 
mode (see Abbreviations and Definitions) was activated at 13.20:36 (15.20:36 CET). This 
is shown by the target symbol changing from a diamond shape (0) to a hash (#) and by an 
arrow next to the target symbol. This can be seen in the images in Appendix |. Due to 
processing delays in the system, the change in display was not expected to coincide with 
the actual time of the last Mode S transmission; the former may occur later. 


The combined primary radar and secondary surveillance radar data from the Russian 
Federation's Air Navigation Service Provider, GKOVD, was provided in the form of a 
video containing a radar screen replay. No other data was received. Due to the absence 
of raw data, it was not possible to verify the video radar replay. The video of the radar 
screen did not show any failures, emergency codes or other alerts of flight MH17. Figure 
6 presents a sample image of the replay of the radar screen and an explanation of the 
data displayed. This primary radar data was available for an area between about 30 to 
60 km to the south of the aeroplane’s final position and about 90 km to the north and 
east and about 200 km to the west. 
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Figure 6: Sample Russian Federation radar screen display. (Source: GKOVD) 


GKOVD data showed flight MH17 as a combined primary and secondary target radar 
symbol and label. The data label for the flight ‘MAS17’ showed the callsign in Cyrillic 
script ‘MAC17’, the flight level ‘330’ and the aeroplane type ‘5772H’ with the ‘B’ in Cyrillic 
script (meaning Boeing 777-200). The number ‘893’ indicated the aeroplane’s grouna- 
speed in km/h. N.B. This image is not of the same moment as the image in Figure 5. 


From the Ukrainian raw radar data it was established that the last secondary radar return 
was at 13.20:03 (15.20:03 CET) with flight MH17 flying straight and level at FL330. The 
video radar replay did not show any primary or secondary radar targets in the vicinity of 
flight MH17 at that time. 


In general, the video replay of the Russian Federation’s combined primary and secondary 
radar data was consistent with the Ukrainian radar data. The following observations were 
made: 


Flight MH17's target was detected by primary and secondary radar; 

The video replay data was consistent with the radar data from Ukraine until 13.20:03 
(15.20:03 CET); 

At 13.20:47 (15.20:47 CET), there was a ‘jump’ from the previous track; this is due to 
the radar re-acquiring the target. In essence, the radar target was coasting and it was 
re-acquired north of the coasting track; 

The target data for flight MH17 was lost on the Russian Federation radar screen at 
13.20:58 (15.20:58 CET). At that moment the secondary radar label changed to 'xxxx’; 
The MH17 label on the radar screen continued to be visible as a coasting secondary 
radar target until 13.22:10 (15.22:10 CET) and until 13.25:57 (15.25:57 CET) as a primary 
radar target; 

A second, primary, target was visible near the MH17 labelled target on two occasions. 
Once between 13.20:47 - 13.21:08 and again between 13.21:18 - 13.25:57 (15.20:47 - 
15.21:08 and 15.21:18 - 15.25:57 CET). 















Regarding other aeroplanes in the vicinity, the surveillance data showed that three other 
aeroplanes flew through the same sector as flight MH17 at around the time of the crash, 
see Figure 7. These three aeroplanes were operating flights for Air India’ (flight AlC113), 
EVA Air (flight EVA88) and Singapore Airlines (flight SIN351). Two of these flights were 
cruising eastbound and one flight was cruising westbound. All flights were under the 
control of Dnipro Radar. At 13.20 (15.20 CET), the distance between flight MH17 and the 
closest of the three aeroplanes was 33 km. 





Figure 7: Image of the Dnipropetrovsk FIR, Sectors 2 and 4, and the flown (black line) and intended (thin black 
line) route of flight MH17. The yellow line represents the centre of airway L980. Also the aeroplane 
type and flight level of the three aeroplanes flying in the same area are shown. The image depicts 
the situation at 13.20 (15.20 CET). (Source: Google, Landsat) 


Summary of the radar data 


e The raw UkSATSE surveillance radar data and the GKOVD radar screen video 
replay both showed flight MH17 on a straight and level flight on FL330 until 
| SnACECs! (1s -ZACRes) (CSI). 

e The GKOVD radar screen showed flight MH17 after 13.20:03 (15.20:03 CET) and 
also showed primary returns in the vicinity of the MH17 target up to 13.25:57 
tlis25-57 CE): 

e According to radar data three commercial aeroplanes were in the same area as 
flight MH17 at the time of the occurrence. Two aeroplanes were flying eastbound 
through the airspace and one was flying westbound. All aeroplanes were under 
the control of Dnipro Radar. At 13.20 (15.20 CET), the distance between flight 
MH17 and the closest of the three other aeroplanes was 33 km. 


2 In the Preliminary Report, Figure 2 showed the relative positions of other traffic. Air India flight AlIC113 was 
erroneously shown as an Airbus A330 and not as a Boeing 787. 
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2.9.5.3. Recording of surveillance radar data 

Both Ukraine and the Russian Federation were requested to provide their surveillance 
radar data of flight MH17. Not all the requested information was provided (see paragraph 
271). 


The Russian Federation did not provide the radar data stating that no radar data was 
saved, but instead provided the radar screen video replay, which showed combined 
surveillance primary and secondary radar. In the absence of the underlying radar data 
(so-called raw data), the video information could not be verified. For analysis, raw data is 
preferred to processed data. The screenshots and video films made of the data, as 
displayed to the controller, whilst of use, were the least preterred media for analysis. 


In accordance with ICAO Annex 11 - Air Traffic Services, paragraph 6.4.1 (Automatic 
recording of surveillance data) states are required to automatically record data from 
primary and secondary surveillance radar equipment systems for use in accident and 
incident investigations, search and rescue, and air traffic control and surveillance systems 
evaluation and training. These recordings shall be retained for a period of at least thirty 
days, and for accident and incident investigation for a longer period until it is evident 
that the recordings will no longer be required. 


The Federal Air Transport Agency of the Russian Federation stated that because the 
crash had occurred outside Russian Federation territory, no radar data was saved, nor 
was it required to be saved by national requirements. The Federal Air Transport Agency 
confirmed that if the event had occurred in Russian Federation territory, the recorded 
radar data would have been saved in accordance with Russian Federation requirements. 
The national requirements for radar data recording management in the Russian 
Federation are included in the following documents: 


e Federal Aviation Regulations ‘CNS and aeronautical telecommunications’, as endorsed 
by Federal Aviation Service Decree Number 115, dated 26 November 2007; 

e Federal Aviation Regulations ‘ATM in the Russian Federation’, as endorsed by Ministry 
of Transport Decree Number 293, dated 25 November 2011. 


The regulation, ‘CNS and aeronautical telecommunications’, states that information that 
is supplied through aeronautical telecommunication networks and radar data sources to 
the displays installed at the working positions of air traffic controllers should be recorded 
by special equipment. 


This is further clarified in the regulation, ‘ATM in the Russian Federation’, in terms of the 
set of recorded information and their storage time. The regulation states that radio 
communications between air traffic control units and flight crew members, air traffic 
controller conversations, pre-flight inspections, weather information transterred by radio, 
radar and flight plan information should be recorded by special equipment. In addition, 
the recorded data should be stored for 14 days using analogue media and for 30 days 
when using digital media. 
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The information provided by the Russian Federation does not mention an exception to 
the requirement to store radar data when that data relates to an area outside the Russian 
Federation territory. When a state cannot, or will not, follow the provisions of an ICAO 
standard, ICAO requires that the difference between the national version of a specific 
standard and ICAO's text be reported to ICAO. The obligation to make such a notification 
was imposed by Article 38 of the Convention on International Civil Aviation. The Russian 
Federation has not filed a difference to ICAO Annex 11 paragraph 6.4.1. 


2.9.6 Communications 

A transcript of the communications between flight MH17, other traffic in the area and air 
traffic controllers, and of communication between air traffic controllers at Dnipro and 
Rostov air traffic control centres is contained in Appendix G to this report. Below is a 
summary of the communication. 


The flight crew of flight MH17 made initial radio contact with Dnipro Radar (Sector 2) at 
12.53:29 (14.53:29 CET) and reported being at FL330. Dnipro Radar (Sector 2) requested 
the flight to climb to FL350 but the flight crew replied that they were unable to do so. Six 
minutes later, MH17's flight crew asked for a clearance to deviate 20 NM to the left ‘due 
to weather’; this request was approved. The flight crew next asked to climb to FL340. 
Dnipro Radar responded that FL340 was not available at the time. 


At 13.07:46 (15.07:46 CET) Dnipro Radar (Sector 2) transferred the flight to Dnipro Radar 
(Sector 4). Contact with this station was established at 13.08:00 (15.08:00 CET). 


After coordinating by telephone with air traffic control in the next sector (Rostov Control, 
in the Russian Federation), which the aeroplane was about to enter, flight MH17 was 
cleared at 13.19:49 (15.19:49 CET) to proceed direct to air navigation waypoint RND. This 
message was confirmed by the flight crew between 13.19:56 and 13.19:59 (15.19:56 and 
1e7 97 Vel. 


At 13.20:00 (15.20:00 CET) Dnipro Radar (Sector 4) further advised flight MH17 to expect 
a further clearance to fly direct to air navigation waypoint TIKNA after passing waypoint 
RND. This message was not acknowledged by flight MH17. From this time until 13.35:50 
(15.35:50 CET) Dnipro Radar (Sector 4) called flight MH17 repeatedly, and also contacted 
Rostov Control, but no response from MH17 was received. The flight crew of the nearby 
aeroplane, Singapore Airlines flight 351, en-route from Copenhagen to Singapore, was 
asked if they could see flight MH17 either visually or on the Airborne Collision and 
Avoidance System display. The flight crew of Singapore Airlines flight 351 answered that 
they could not see flight MH17. Singapore Airlines flight 351 also tried, without success, 
to contact flight MH17 by radio on the emergency frequency 121.5 MHz. Following the 
transmission at 13.20:00 (15.20:00 CET), the last radio transmissions trom Dnipro Radar 
(Sector 4) to flight MH17 were ten unanswered calls between 13.26 (15.26 CET) and 13.35 
(15.39: CET), 


No distress messages from flight MH17 were received by air traffic control. 
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Summary of the radio communications 


e The last radio transmission made by flight MH17 began at 13.19:56 (15.19:56 CET) 
and ended at 13.19:59 (15.19:59 CET). 

e The last radio transmissions made by Dnipropetrovsk air traffic control centre 
(Dnipro Radar) to flight MH17 began at 13.20:00 (15.20:00 CET) and ended at 
13.35:50 (15.35:50 CET). The flight crew did not respond to these transmissions. 

e No distress messages from flight MH17 were received by air traffic control. 


2.9.7. Airborne Warning and Control System aeroplanes 
Two NATO Airborne Warning and Control System (AWACS) aeroplanes conducted 
missions in NATO airspace over Poland and Romania on 17 July 2014. 


In correspondence with the Dutch Safety Board, the NATO Supreme Allied Commander 
Europe stated that the AWACS aeroplanes detected flight MH17 during its flight but the 
aeroplane ‘had flown beyond NATO AWACS coverage well before it crashed’. He noted 
that, following a request from the Dutch Safety Board, NATO specialists had re-analysed 
the data that had been collected by the AWACS aeroplanes on 17 July but that ‘there is 
no data from the AWACS which would be relevant to the investigation of the crash. 
Supreme Headquarters Allied Powers Europe does not hold any other radar or other 
AWACS data relevant to MH17’. 


Summary of the information regarding AWACS aeroplanes 


NATO AWACS aeroplanes did not have information pertinent to the investigation. 


2.10 Aerodrome information 


Not applicable to this investigation. 


2.11 Flight recorders, satellite and other data 


2.11.1 Recovery of Cockpit Voice Recorder and Flight Data Recorder 

The Cockpit Voice Recorder and Flight Data Recorder were not recovered by the Annex 13 
investigation team. Individuals unknown to the investigation team removed the two flight 
recorders from the wreckage area. On 21 July 2014, the recorders were handed over to a 
Malaysian official in Donetsk, Ukraine by representatives of the armed group present in 
the area. On 22 July 2014, the recorders were handed over to the Dutch Safety Board in 
Kyiv, Ukraine. Appendix H contains further information on the Cockpit Voice Recorder and 
the Flight Data Recorder readouts and data analysis. 
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Both flight recorders had two sets of text labels, one in Cyrillic text and one in French. The 
manufacturer's text labels were in French and, on the other side of the recorder, in English. 
The other text label was in Cyrillic text on the recorder unit and read ‘The Prosecutor 
General's Office of the Donetsk People’s Republic’. These text labels were not added by 
the Dutch Safety Board, but were on both data recorders when they were handed over to 
the Safety Board. 


No evidence or indications of manipulation of the flight recorders were found. 


2.11.2 Cockpit Voice Recorder 

The housing of the Cockpit Voice Recorder (Figure 8) was damaged. The model and 
serial numbers were unreadable on the data plate, but the serial number 1366, was 
stamped on the underside of the chassis. The serial number 1366 was also provided by 
Malaysia Airlines. The external damage to the Cockpit Voice Recorder was consistent 
with impact damage; however, the internal memory module was intact. The Cockpit 
Voice Recorder was successfully downloaded and contained valid data from the flight. 
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Figure 8: Cockpit Voice Recorder. (Source: Dutch Safety Board) 


The replay of the communications recorded on the Cockpit Voice Recorder matched air 
traffic control communications with flight MH17 (see Appendix G). The audio recording 
indicated that besides the flight crew, a cabin crew member was in the cockpit. The 
audio recording included the internal cockpit flight crew communication which contained 
no indication that there was anything unusual with the flight. The Cockpit Voice Recorder 
audio recording ended abruptly at 13.20:03 (15.20:03 CET). A replay of the Cockpit Voice 
Recorder audio recording did not identify any aeroplane aural warnings or alerts of 
system malfunctions. One of the four recorded audio channels, the cockpit area 
microphone, was of poor sound quality. The relevant parts of the Cockpit Voice Recorder 
audio recording were integrated with the air traffic control transcript in Appendix G of 
this report. 


At the end of the recording, two sound peaks were identified on the last 20 milliseconds 
of the recording. A graphic representation of the two sound peaks for the four Cockpit 
Voice Recorder microphones is shown in Figure 9. 
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Microphone P2 (First Officer) 
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Microphone P1 (Captain) 


Figure 9: Sound peaks recorded at the end of the CVR recording. (Source: Dutch Safety Board) 


The time period shown on each image is 4 milliseconds. The sound identified as ‘peak 1’ 
was only recorded on the cockpit area microphone (CAM). 


2.11.3 Flight Data Recorder 

The Flight Data Recorder (Figure 10) was manufactured by Allied Signal, model number 
980-4700-003 and serial number 2196. The serial number matched the details provided 
by Malaysia Airlines. The recorder that was given to the Dutch Safety Board had no 
Underwater Locator Beacon attached. 


The exterior of the flight data recorder was slightly damaged, but the internal memory 
module was intact. The external damage on the Flight Data Recorder and the loss of the 
underwater locator beacon was consistent with impact damage. The Flight Data Recorder, 
designed so that a minimum of the last 25 hours of operational data is retained on the 
recording medium, was successfully downloaded and contained valid data from flight MH17. 
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4 


Figure 10: Flight data recorder without Underwater Locator Beacon. (Source: Dutch Safety Board) 


The data '° on the Flight Data Recorder showed that the aeroplane was flying at 33,000 feet, 
on a constant displayed heading of 115° and at a constant computed airspeed of 
293 knots.'' The recording had stopped abruptly at 13.20:03 (15.20:03 CET). The Flight 
Data Recorder showed that the aeroplane’s position at 13.20:02 (15.20:02 CET) was 
48.12715 N 38.52630538 E. 


No aeroplane or engine system warnings or cautions were found on the recorded data. 
For engine parameters and pressure cabin parameters used in the investigation, see 
Appendix H. 


Summary of the data recorder information 


e Both the Cockpit Voice Recorder and Flight Data Recorder were recovered and 
both contained recordings that could be used. Both recordings ended abruptly 
at 13.20:03 (15.20:03 CET). 

e No aural alerts or warnings of aeroplane system malfunctions were heard on the 
Cockpit Voice Recorder. The communication between the flight crew members 
gave no indication of any malfunction or emergency prior to the end of the flight 
recorder recordings. 

e Two peaks of sound were identified on the last 20 milliseconds of the Cockpit 
Voice Recorder recording. 

e No technical malfunctions or warnings in relation to flight MH17 were found on 
Flight Data Recorder data. 

e The engine parameters were consistent with normal operation during the flight. 
No engine or aeroplane system warnings or cautions were detected. 


10 Additional data extracted from the Flight Data Recorder is produced in Appendix H. 
11 The recorded groundspeed was 494 knots or 914 kilometres per hour. 
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2.11.4 Quick Access Recorder 

The aeroplane was equipped with a Quick Access Recorder (QAR). This unit, installed in 
the rear part of the aeroplane, records similar data to the Flight Data Recorder and is, as 
its name suggests, easily accessible for, anong other things, maintenance purposes. The 
QAR was not recovered. 


2.11.5 Emergency Locator Transmitters 

The aeroplane was equipped with two Emergency Locator Transmitters. One Emergency 
Locator Transmitter was a fixed unit mounted in the aeroplane (Model ADT 406 AF) and 
the other unit was a portable unit to be used during emergency evacuations (Model ADT 
406 AP). The Emergency Locator Transmitters operate on three frequencies: 406 MHz, 
243 MHz and 121.5 MHz. The Emergency Locator Transmitters were powered by high- 
energy lithium batteries and are capable of transmitting signals for at least 60 hours. 


Each Emergency Locator Transmitter was uniquely identifiable by a hexadecimal code 
embedded into the Emergency Locator Transmitter software. More information on the 
Emergency Locator Transmitter is described in Appendix H. 


The tixed Emergency Locator Transmitter, located in the aft section of the aeroplane, 
was connected to the cockpit remote control panel for manual activation. The Emergency 
Locator Transmitter was connected to an antenna on top of the fuselage and it also had a 
back-up antenna. 


The portable Emergency Locator Transmitter was located in a stowage area to the right 
of the forward passenger door 1R. The portable Emergency Locator Transmitter had only 
a manual activation system. It was not recovered. It had not been activated, because no 
data was found to have been received by the ground stations. 


The fixed Emergency Locator Transmitter can be activated in one of three ways, 
automatically, manually using a switch in the cockpit or manually using a switch on the 
Emergency Locator Transmitter unit. The Emergency Locator Transmitter system logic is 
designed to transmit the first encoded signal after 30 seconds when automatically 
activated and after 50 seconds when manually activated. The automatic activation is 
based on a G-Switch in accordance with the EUROCAE ED-62 standard. The threshold 
for activation is 2.0 to 2.6 g acceleration directed in the direction of flight of the aeroplane. 
Normal turbulence during flight will not activate the Emergency Locator Transmitter. 
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Emergency Locator Transmitter detection 


After the Emergency Locator Transmitter has been activated, the detection and 
localisation process has two stages. Firstly, the Emergency Locator Transmitter 
emergency signal is picked up by at least one of the six satellites in a geosynchronous 
orbit that contain Emergency Locator Transmitter reception equipment. These signals 
are then relayed to one or more of 31 ground stations. Secondly, when a low-earth 
orbit satellite (five such satellites have Emergency Locator Transmitter signal detection 
equipment) passes overhead the Emergency Locator Transmitter, its signal is used to 
calculate the position of the Emergency Locator Transmitter. Again, this information 
is relayed to ground stations. This second detection may have a delay, as more than 
one low-earth orbit satellite pass may be required to determine the Emergency 
Locator Transmitter’s position. As the location determination process is done on the 
basis of the Doppler shift principle, two possible locations are generated and by 
correlation of subsequent satellite passes one of the two locations is eliminated. 


On 10 July 2014, a test signal during maintenance from the fixed Emergency Locator 
Transmitter was detected by a satellite and relayed to three ground stations. On 17 July, 
five ground stations received an Emergency Locator Transmitter signal which had been 
relayed by two satellites between 13.20:35 and 13.20:36 (15.20:35 and 15.20:36 CET). 
This signal was active until 11.48:06 (13.48:06 CET) on 18 July.'* The locations of the fixed 
Emergency Locator Transmitter as transmitted by the satellites showed that the 
Emergency Locator Transmitter was located, up to the moment that transmissions ended, 
in wreckage site 4. This was the site that contained, among other parts, the fuselage 
between the wing and the tail section (see Section 2.12). 


The fixed Emergency Locator Transmitter was not recovered by the investigation team, 
although the fuselage structure at the rear of the aeroplane onto which the fixed 
Emergency Locator Transmitter was mounted was recovered. Figure 11 shows the typical 
installation of a fixed Emergency Locator Transmitter in a Boeing 777 (left) and the panel 
recovered from the wreckage of flight MH17 where the fixed Emergency Locator 
Transmitter was mounted (right). 





12 Appendix H provides more information on the times of the receipt of the Emergency Locator Transmitter signal. 


ih = y 4 49 of 279 









Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 
7 Flying over 
Ukraine 


Part B: 
9 Assessing the 
aL « 


ai 
Recommendations 


16 
List of appendices 


Pe aA OMe reset 


se! OT Leal ate 





Figure 11: Fixed ELT location installed in a Boeing 777 (left), panel recovered from 9M-MRD with no insulation 
material or ELT attached (right). (Source: Dutch Safety Board) 


Summary of the data from the Emergency Locator Transmitters 


e The aeroplane was equipped with two Emergency Locator Transmitters, one 
fixed and one portable. Neither Emergency Locator Transmitter was recovered. 

e The fixed Emergency Locator Transmitter was automatically activated and its 
signal was detected at 13.20:35 - 13.20:36 (15.20:35 - 15.20:36 CET). No signal 
was detected from the portable Emergency Locator Transmitter. 

e The fixed Emergency Locator Transmitter transmitted from a location in wreckage 
site 4 until 11.48:06 (13.48:06 CET) on 18 July 2014. 


2.11.6 Other aeroplane data 
Two other recorded data sources that were obtained for the investigation were: 


e Data transmitted by Very High Frequency (VHF) radio, and 
e Data transmitted by Satellite Communication (SATCOM). 


The SATCOM data was of interest to the investigation because, unlike VHF radio, 
SATCOM interrogates the aeroplane’s system if no data is exchanged for more than 


about 15 minutes. 


2.11.6.1. Satellite Communication 


SATCOM is a radio system that uses a constellation of satellites used to transmit voice 
and data (see explanation below). Aircraft Communication Addressing and Reporting 
System (ACARS) (see Abbreviations and Definitions) can make use of SATCOM to transmit 
data to ground stations. The SATCOM system used by the aeroplane was linked to the 
Inmarsat network. 
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SATCOM and Inmarsat 


The Satellite Communication system uses aircraft earth stations to provide the aircraft 
interface to the Inmarsat satellites. Inmarsat is a provider of global mobile satellite 
communications services, delivering voice and high-speed data communications on 
land, at sea and in the air. Inmarsat operates several satellites in geosynchronous orbit. 


Four satellites cover the oceans and the three major landmasses. Their combined foot- ae 
prints provide worldwide communications coverage except in the extreme Polar 


Regions. Inmarsat also has a terrestrial network to receive satellite messages, so-called aa 
land earth station operators. One of these stations is located in Burum, the cereals 
Netherlands. It was this station that received data from flight MH17, prior to relaying 

the data further on the Inmarsat ground network. 


SATCOM transmissions were recorded as having taken place throughout the flight at 

irregular intervals between 10.11 (12.11 CET) and 13.08 (15.08 CET). The transmissions ea rtrd fos 
were relayed via two satellites. The last transmission from flight MH17 by SATCOM was laa 
between 13.07:26 and 13.08:51 (15.07:26 and 15.08:51 CET). The ground station had an 
inactivity timer. After approximately 15 minutes the ground station checked to see if the 
aeroplane terminal was still operating by sending a message to the system: a so-called 
Log-on Interrogation. As the ground station did not receive a reply trom flight MH17, the 
Log-on Interrogation message was sent two more times; again without reply. The ground 
station's logic then considered that the aeroplane’s reception terminal was not operating. S Saha me 
This occurred at 13.21:26 (15.21:26 CET), 14 minutes after the previous transmission 


commenced. 


2.11.6.2 Aircraft Communication Addressing and Reporting System 
The following Aircraft Communication Addressing and Reporting System (ACARS) 
messages were sent/received on 17 July 2014 to and from the aeroplane: eee 


7 Flying over 
Ukraine 


e load sheet and mass and balance information; 
e Auxiliary Power Unit report; 

e engine data (take-off and climb); 

® position reports; 

e flight route information; 


Part B: 
® communication status messages (uplink messages). 9 Assessing the 


Le 
The ACARS data showed a total fuel quantity of 96,400 kg. This is 100 kg less than is 
recorded on the technical log and is considered to be a small inconsistency between the 
different measuring means. The maximum fuel capacity of the aeroplane type, according 
to Boeing, was 135,224 kg. The margin between the actual take-off mass of 278,691 kg 
and the aeroplane’s maximum take-off mass of 286,897 kg was 8,206 kg. o 
Recommendations 
According to the aeroplane’s load sheet 86,900 kg of fuel was required as trip fuel for the 
flight. Trip fuel is defined as being the fuel quantity required for the period of the flight 
from take-off to landing. It excludes fuel required for taxi-out and taxi-in, but includes the 
fuel required for known or expected weather conditions or air traffic control restrictions. 
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The fuel planned to be remaining on landing at Kuala Lumpur was 8,800 kg. ACARS data 
showed that the engines were consuming an average of 8,758 kg of fuel per hour in the 
two hours of cruise flight for which ACARS reports were available. Flight Data Recorder 
data showed that the fuel on board immediately prior to the end of the recording was 
70,100 kg. 


The timing and content of several messages could be veritied by cross reference of other 
sources; e.g. Rolls-Royce and Inmarsat. The first ACARS message from the aeroplane on 
17 July was transmitted at 09.24 (11.24 CET) from Schiphol. 


At 09.56:35 (11.56:35 CET), an ACARS transmission of the load sheet was recorded. The 
Rolls-Royce engine take-off and climb reports tor the Engine Health Monitoring 
programme were sent to Malaysia Airlines at 10.31:20 (12.31:20 CET) and 10.48:32, 
(12.48:32 CET), respectively. 


Engine Health Monitoring 


Engine Health Monitoring is a system that intermittently records a number of engine 
parameters for the purpose of maintenance trend monitoring of the engine’s 
performance. More details on Engine Health Monitoring are included in Appendix J. 


Various position reports, generated between take-off at Schiphol and 13.12 (15.12 CET), 
were transmitted by ACARS. ACARS Message number 50868018 showed that at 12.57:32 
(14.57:32 CET), the last position report was sent. 


ACARS Message number 50868202 was the last SATCOM transmission and it was 
recorded at 13.07 (15.07 CET). The final ACARS VHF radio transmission was, according to 
the ACARS log, made at 13.12 (15.12 CET). Later messages sent from the ground to the 
aeroplane were not received by the aeroplane. These messages were stored by Malaysia 
Airlines and were available to the investigation. 


Summary of the other recorded data 


None of the recorded data sources indicated that electrical power was available on 
flight MH17 after 13.20:03 (15.20:03 CET). 


2.12 Wreckage and impact information 
The following paragraphs describe the geographic area of the crash and wreckage as it 


was found. Details are provided on the location, identification and observed damage of 
the wreckage pieces. 
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2.12.1 Crash area access 

Under escort of the Organisation for Security and Cooperation in Europe (OSCE), air 
accident investigators from Ukraine and Malaysia, the Australian Federal Police and 
journalists had access to the crash area in the days following the crash. During these 
visits, the wreckage was photographed extensively and showed the locations mostly 
undisturbed. The information gathered was shared with the Dutch Safety Board. 


Due to the security situation within the geographic area of the crash, the Dutch Safety 
Board was unable to start the collection and preservation of the wreckage directly after 
Ukraine had delegated the investigation to the Netherlands. 


It was not until 4 November 2014 that the Dutch Safety Board was able to visit the various 
locations where the wreckage was located, under the protection of the Dutch Ministry of 
Detfense’s Recovery Mission. Starting on 16 November, after receiving permission from 
local authorities, wreckage parts were collected during six days and transported to the 
Netherlands for the investigation and partial reconstruction of the aeroplane. It was 
necessary to cut some parts into smaller pieces for transport. 


It was not until 20 March 2015 that it was possible to gain access to the site north-west of 
the village of Petropavlivka for the first time. Between 19 April and 2 May, pieces of 
wreckage that had been collected by local residents were recovered. 


It should be noted that many pieces of the wreckage were not physically examined by 
the Dutch Safety Board until four months after the crash. During this period some parts 
were removed, therefore it was not possible to retrieve all wreckage pieces. Wherever 
possible, the photographs taken immediately after the crash were used in conjunction 
with the wreckage found. 


2.12.2 General distribution and description of the wreckage 

The wreckage parts of the aeroplane were identitied within an area of approximately 
50 km?. Most of the wreckage was located on six sites within this area. The majority of 
the wreckage was located in three of these sites to the south-west of the village of 
Hrabove. Figure 12 shows the geographic location of the six wreckage sites. Each 
wreckage site has an associated colour. The distribution of wreckage pieces over a large 
area indicates an in-flight break-up. 


Boor 277 









Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 
7 Flying over 
Ukraine 


Part B: 
9 Assessing the 
aL « 


a 
Recommendations 


16 
List of appendices 





O Site 1 
O Site 2 
@ Site 3 
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Petropavlivka 
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Figure 12: Overview of wreckage area showing the six smaller sites. (Source of satellite images: Google Earth/ 
Digital Globe) 


Table 9 gives an overview of the wreckage sites that are described in this paragraph. 
Outside of the six specified sites, no items of note were identified. Between sites 3 and 
4, personal belongings, as well as small pieces of wreckage originating from the aft side 
of the aeroplane were found. 


1 O Yellow Farm land ZZ 
2 @ Orange Residential area of Petropavlivka 2122.2 
3 @ Red Farm land south of the village of Rozsypne 21228 
4 @ Green A built-up area partially surrounded by a forest ina gully § 2.12.2.4 
5 O Blue Farm land separated by an elevated road 2ZAZ2 5 
6 @ Purple Farm land separated by an elevated road southwest of 2.12.2.6 


the village of Hrabove 


0 @ Black Parts of wreckage of which the initial location could not PZ 
be verified 


Table 9: Description of wreckage sites in this report. 


Figure 13 shows the origin of the wreckage pieces that were recovered from the various 


wreckage sites by the Dutch Safety Board. 
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Figure 13: Side view left (top) and right (bottom). Identification of wreckage retrieved from the wreckage sites. 


The retrieved parts of the wings, engines and horizontal stabilizers, found in sites 5 and 6, are not 


shown in this image, but are described in the following paragraphs. (Source: Dutch Safety Board) 


As a result of shelling within the geographic area of the crash, the Dutch Safety Board 
was not able to retrieve all identified wreckage pieces during the recovery mission in 
November 2014. The site in which these wreckage pieces were located was either not 
accessible to the Dutch Safety Board or the pieces were no longer present at their impact 
location. Table 10 indicates the wreckage pieces not able to be recovered. 





Se 


Cockpit fuselage top section 


Fuselage top above business class (two pieces) 
Fuselage left hand side with positive pressure relief valves 
Forward section passenger floor (business class) 


Fuselage with windows and door frame of door 1L 


Fuselage with door frame of door 1R and surrounding fuselage 


Table 10: Wreckage parts not able to be recovered. 
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The following paragraphs provide, per wreckage site, a detailed description of the 
wreckage parts, relevant for the analysis. In the description of the pieces of wreckage of 
the aeroplane, Boeing references such as sections and stations (STA) are used. Information 
on these two means of reference is provided in the list of Abbreviations and Definitions. 


2.12.2.1_ Wreckage site 7 (yellow) 

This site of approximately 3 km7%, is located 8.8 km west of the village of Hrabove. Parts of 
wreckage were distributed over three agricultural fields which were separated by roads 
and vegetation. No fire nor infrastructure damage was observed on this site. An overview 
of the wreckage sites 1, 2 and 3 and the locations of the wreckage pieces is depicted in 
Figure 14. 


Sites 1, 2 and 3 


Legend 

— Road 

(J Residential area 
--- Railway 

[1] Wreckage location 


Site 1 
Upper left hand cockpit fuselage* 
Upper part fuselage above business 
class (forward)* 
Upper part fuselage above business 
class (aft)* 
Right hand fuselage with partial text 
“Malaysia” 
Left hand fuselage with positive 
pressure relief valves* 


Site 2 
Left hand fuselage with door frame of 
door 1L* 
Right hand fuselage with door frame of 
door 1R* 
Left hand fuselage with door frame of 
door 2L 
Lower fuselage with forward cargo 
floor 
. Right hand fuselage with door 2R 
. Left engine intake ring 
. Cockpit fuselage 
. Forward section passenger floor, 
mL. business class 
© _'% Site 3 


Site 3 

14. Cockpit, including forward bulkhead, 
forward cargo hold, nose gear wheel 
bay, avionics 


Parts not retrieved by the Dutch Safety 
Board 


600 mi A 
N 


Figure 14: Overview of wreckage sites 1, 2 and 3 and the locations of the wreckage pieces. (Source: Dutch 
Safety Board) 


The numbers in brackets following the titles below correspond with the locations in 
Figure 14. 


Upper left hand cockpit fuselage (1) 
A portion of the cockpit fuselage’s top section (STA236.5 to STA332.5) was located in the 
south-western region of site 1 (Figure 15). This part was not recovered. The fuselage skin 
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showed evidence of perforation from the outside. The aft side of the fuselage skin was 
bent upwards and a number of formers and stringers were missing from the fuselage. 
The upper side of the fuselage showed traces of soot. 





Figure 15: Upper left hand cockpit fuselage. (Source: DCA Malaysia) 


Upper parts of fuselage above the business class (2 and 3) 

The upper side of the forward fuselage (section 41), above the business class, was found 
in two pieces. The distance between the two pieces of fuselage was approximately 
150 metres. 


The foremost part of the upper fuselage (STA357.25 to STA529) was found in the southern 
region of site 1. The inner portion of the fuselage was facing upwards and the Traffic 
Alert and Collision Avoidance System (TCAS) antenna module was visible. A number of 
formers and stringers were partly detached from the fuselage and others were broken. 


The aft portion of the upper fuselage (STA529 to STA655) was located in the south of 
site 1. The exterior side of the fuselage was facing upwards and showed evidence of 
perforation from the outside. The upper transponder antenna, attached to the outside of 
the fuselage, showed no signs of damage. 


The upper parts of the fuselage above the business class were no longer present at the 
time of the recovery mission. 
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Right hand fuselage with partial text ‘Malaysia’ (4) 

A wreckage piece with a partial print of the text ‘Malaysia’ belonging to section 43 and 
section 45 (STA846 to STA1032) on the right hand side of the aeroplane was located on 
the south-eastern side of site 1. The upper portion of the fuselage had sheared just 
above the text and the letter ‘M’ on the left hand side of the wreckage piece appeared 
to be missing. All edges showed clear shears. Halfway, the fuselage was partially sheared 
from top to bottom. Formers and stringers were no longer attached to the fuselage. 


Left hand fuselage with positive pressure relief valves (5) 

The part of the fuselage containing the two positive pressure relief valves was found in 
the south of site 1. The fuselage part of the left hand side of the aeroplane (STA529 to 
STA655), also contained a static port and six passenger windows. Photographic evidence 
showed that both positive pressure relief valves were found in a closed position. The 
upper side of the fuselage was sheared just above the window frames. This wreckage 
piece was no longer present at the time of the recovery mission. 


Cockpit and cabin furnishing 
In site 1, pieces of cockpit and cabin furnishing, including the Captain's charts folder and 
pieces of a galley trolley, were found. A single overhead luggage bin, belonging to row 
11 JK was found on the eastern region of the site. The surrounding overhead luggage 
compartments were missing. 


Cargo 

Fragments of two cargo containers with registration AKE3951MH and AKE3540MH were 
identitied on site 1. In total six textile rolls each with a length of approximately 100 metres 
were located in the northern region of site 1. These rolls were identified as being part of 
the cargo. The cargo manifest indicated that in the forward- and aft cargo compartment 
of the aeroplane, two unit load devices, each carrying 10 textile rolls, had been loaded. 
These pieces of cargo were used as part of the trajectory analysis in paragraph 3.11.7. 


2.12.2.2 Wreckage site 2 (orange) 
This site of approximately 2.5 km?, covers a large part of the village of Petropavlivka and 
is located 8 km west of Hrabove. Several structures in the village of Petropavlivka were 
damaged by debris. An overview of the wreckage site and the location of the wreckage 
pieces is depicted in Figure 14. 


Left hand fuselage with door frame of door 1L (6) 

The door frame of door 1L (STA309.5 to STA529) with surrounding fuselage was located 
in the northern region of site 2. The inner structure of the fuselage was facing upwards 
and the frames of six passenger windows were visible. Photographic evidence showed 
traces of soot on the bottom portion of the fuselage and the absences of the upper door 
sill. This wreckage piece was not recovered from the wreckage site. 


Cockpit and cabin furnishing were found nearby the fuselage. However, the initial impact 
location of this furnishing on the ground could not be veritied due to the absence of 
photographic and video evidence. It is of note that as time went by, pieces of wreckage 
were collected by the residents of Petropavlivka. 
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Right hand fuselage with door frame of door 1R (7) 

The fuselage near door 1R (STA276.5 to STA345) was located parallel to a dirt road in the 
western region of site 2. The exterior side of the fuselage was facing upwards and a 
portion of the door frame of door 1R was visible. This wreckage piece was no longer 
present at the time of the recovery mission. 


Left hand fuselage with doorframe of door 2L (8) 

The fuselage near door 2L (STA655 to STA930) was found in a yard in the north-eastern 
region of area 2. The exterior side of the fuselage was facing upwards and the upper side 
of the fuselage was folded in longitudinal direction. The fuselage contained three 
windows. The upper portion of the fuselage contained the casing of the anti-collision 
light. A partial letter (‘M’) of the text ‘Malaysia’ was visible. 


Lower fuselage with forward cargo floor (9) 

Pieces of the cargo floor (STA634 to STA888) were found in Petropavlivka, in the centre 
of site 2. The skin on the right hand side of the fuselage had sheared just above the 
cargo floor and the cargo rails itself were visible. The fuselage was relatively intact, aside 
from shear damage. Two static ports were visible on the right hand side of the fuselage. 
Cracks were observed in the transverse direction on the cargo floor. 


The left nose wheel landing gear door and the casing of the right negative pressure relief 
vent were found near the cargo floor. 


Right hand fuselage with door 2R (10) 

The fuselage containing door 2R was identified in the eastern region of site 2. The 
fuselage surrounding door 2R had sheared above the text ‘sia’ near STA655 on the left 
side and STA888 on the right side. 


The door was positioned in the door frame and the fuselage had sheared below the 
frame of the left negative pressure relief valve. The left negative pressure relief valve was 
attached to the upper portion of the frame and the valve was pinned in its open position 
between the casing and the ground. Neither the frame nor the door of the right negative 
pressure relieve valve were found at site 2. 


The negative pressure relief valve itself was cracked over the half of its vertical length. 


The valve showed damage consistent with the valve being fully opened and striking the 
adjacent rib (Figure 16). 
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Figure 16: Inside of the valve in closed position with crack and marked bracket. Inset shows detail of the eine tee 





bracket with pin showing damage on pin and rib. (Source: Dutch Safety Board) 


Left engine intake ring (11) , eee See 
The leading edge of the left engine intake ring was found in the south-eastern region of is 


site 2. The ring showed perforation damage on approximately the 40, 50, 60, 135, 180, 


200, 290 and 300 degree positions, aft looking forward. See Figure 17. leat 
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Figure 17: Damaged left engine intake ring, with impact marks seen from the front side (left photo) and from Abbreviations and 


the rear side (right photo). (Source: Dutch Safety Board) Definitions 


p 60 of 279 6 
a a gy t List of appendices 





Cockpit fuselage (12) 

Part of the fuselage, originating from the left hand side of the cockpit was identified in a 
garden in the central region of site 2. This part contained numerous puncture holes and 
pitting. It also showed traces of soot. The formers on the inner side of the fuselage had 


been sheared off. See Figure 18. 





Figure 18: Part of fuselage left hand side showing holes and pitting. (Source: Dutch Safety Board) 


Forward section passenger floor (business class) (13) 

A portion of the cabin floor from section 41 was located in the south-eastern region of 
site 2. The cabin floor contained business class seats which were tilted in a downward 
position, but still attached to the seat racks. This wreckage piece was no longer present 
at the time of the recovery mission. 


Cabin furnishings 

Cabin furnishings such as passenger seats and overhead bins were spread across site 2. 
These items belonged primarily to section 41 and 43 of the aeroplane. In the eastern 
region of the site, parts of the overhead passenger service unit with reference STA74/7, 
situated above door 2L, and the centre overhead luggage compartment of row 2 were 
identified. The distance between the overhead passenger service unit and the overhead 
luggage bin was approximately 260 metres. 


The passenger service unit was equipped with a television screen which appeared to be 
intact. The latch that seals the casing housing the oxygen masks, was missing and the 
oxygen masks were deployed. The position of the solenoid could not be verified due to 
the absence of photographic evidence. 
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A centre overhead luggage compartment was located in a line of trees. The compartment, 
with overhead luggage bins on both sides, came from the centre section above rows 1 
and 2. One of the overhead bins had a placard with ‘2 DFG’, indicating row 2 seat D, F 
and G. The overhead luggage compartment contained fragments of 5 overhead bins. 


2.12.2.3 Wreckage site 3 (red) 

The cockpit and most of the lower part of the surrounding fuselage (section 41) was 
found in site 3 (Figure 14), about 7 km south-west of Hrabove. The site, approximately 70 
x 40 metres, was located in a sunflower field situated on the southern corner of the village 
of Rozsypne. Within this relatively concentrated site, cockpit instruments, avionics 
equipment and fragments of cabin and cargo furnishings were found. Aside from 
flattened vegetation, shallow impact marks were observed on the ground. The distance 
between the site where the cockpit fell and the place where the first larger pieces of 
wreckage were found, near wreckage site 4, is approximately 6 km. 


Photographic and video evidence trom the days after the crash indicated that site 3 had 
been disturbed and aeroplane parts and cargo had been removed from the site. A 
number of avionics units, photographed by third parties following the days of the crash, 
were no longer present during the recovery mission of the Dutch Safety Board in 
November 2014. 


General description cockpit and surrounding fuselage (14) 

The forward portion of the aeroplane, part of the cockpit including the forward bulkhead, 
was found in a tilted nose-down position facing in an easterly direction. The cockpit and 
surrounding fuselage had separated in the longitudinal direction of the aeroplane 
revealing cockpit and cabin furnishings. It is of note that the upper portion of the cockpit 
fuselage was not located in site 3. 


The nose landing gear wheel bay and the avionics compartment had perforated the 
cockpit floor and cabin floor pushing it in an upward direction. The adjacent cabin floor 
had separated in the longitudinal direction into two pieces. The left portion of the cabin 
floor was still attached to the fuselage and parts of the left galley were visible. Other 
than the severe structural damage of the fuselage, the bottom portion of the fuselage 
was found as a whole. The fuselage on the right hand side of the aeroplane had sheared 
behind the large cargo door and the adjacent cargo floor was visible. 


On the left hand side of the cockpit, between STA132.5 and STA220.5 of the aeroplane, 
no pieces of fuselage were recovered. The left angle of attack sensor, still attached to a 
portion of the fuselage, was located in the vicinity of the cockpit wreckage. 


The right hand side of the cockpit remained fairly intact. The window panes of the right 
cockpit windows were still in place. The presence of soot is noted on the inside of the 
right cockpit windows 2 and 3. The upper portion of the right hand side of the fuselage 
showed evidence of both perforation and ricochet marks. In contrast to the left hand 
side of the cockpit (see paragraph 2.12.2.7), the lower right hand side did not show similar 
signs of perforation from the outside (see Figure 19). The size of the perforation holes is 
detailed in paragraph 2.6 of Appendix X. 


6201 277 





eo 9 









Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 
7 Flying over 
Ukraine 


Part B: 
9 Assessing the 
aL « 


ai 
Recommendations 


16 
List of appendices 


Pig ee ul trite 





Figure 19: Part of the right hand side of the cockpit. (Source: Dutch Safety Board) 


There was perforation damage on the forward pressure bulkhead. Three holes were 
visible. Parts of the cockpit fuselage were still attached to the left hand and right hand 
side of the forward bulkhead (Figure 20). The left hand side of the fuselage attached to 
the forward pressure bulkhead contained numerous puncture holes and pitting was 
observed (Figure 21). The right hand side of the fuselage attached to the forward 
pressure bulkhead had no perforation damage. 
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Figure 20: Forward pressure bulkhead and right hand Figure 21: Puncture holes on left hand 
fuselage. (Source: Dutch Safety Board) fuselage at the forward pressure bulkhead. 
(Source: Dutch Safety Board) 


A large part of the cockpit floor was found, broken up in several parts, and stripped of 
most of its content, see Figure 22. Seats, centre console, wall structure and most of the 
control mechanics were separated from the floor structure; only part of the first officer's 
control mechanism remained attached. A part of the right hand side of the cockpit floor 
was attached to the aft side of the forward pressure bulkhead. This piece of wreckage 
included a significant part of the first officer's controls and the associated link mechanism. 
It was extensively deformed and the construction was folded in on itself. 
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The fuselage skin (STA250 and STA330) was pushed in between the stringers and frames, 
see Figure 23. 















Figure 23: Fuselage skin pushed in between stringers and frame. (Source: Dutch Safety Board) 


The floor part left of and below the captain's seat was recovered. This part of the floor 
was punctured extensively and was also covered in soot and showed signs of heat 
damage. The lower part of the captain’s control column showed signs of perforation 
(Figure 24); the upper part was not recovered. 





Figure 24: Lower part of Captain’s control column showing perforation damage. (Source: NLR) 


Within close proximity to the cockpit wreckage, cockpit furnishings, including pilot seats 
and cockpit instruments were found. Together with parts of the cockpit floor, the throttle 
quadrant and pedestal had been pushed in an upward direction. The left hand side plate 
and the throttle quadrant showed perforation damage (see Figure 25). The remainder of 
the cockpit instruments such as the Mode Control Panel and a number of cockpit display 
units were found in a heap. A large part of the centre pedestal was recovered. 
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Figure 25: Throttle quadrant (viewed from the left hand side) showing perforation damage. (Source: NLR) 





Most of the captain’s seat was recovered in close proximity to the wreckage. It was found 
in three parts: seat bottom, backrest and headrest. All of the parts showed perforation 
damage and signs of distortion by ground impact. 


The main structure of the first officer's seat was deformed and had perforation holes, 
mainly on the backrest support. The floor plate to the left of the seat showed extensive 
holing, as did the headrest panel. See Figure 26. 





Figure 26: Backrest support of first officer’s seat, showing perforation damage. (Source: NLR) 
The seat base with some of the backrest structure of the first observer seat was recovered 
together with part of the floor structure it was attached to. The metal part of the headrest 


was found separately. All parts showed impact damage. 


Smaller numbers of impact holes were present in other locations, including below the 
second observer seat (Figure 27). 
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Figure 27: Perforation holes in seat back panel of left observer seat. Note: The seat back panel is shown flat 


on the floor in this image. (Source: NLR) 


From the area just behind the cockpit, at the level of the first doors, one part of the floor 
(composite honeycomb structure) was retrieved. The floor panel included a number of 
beams, but lacked all of the structure above floor level. The part showed some damage, 
but no perforation damage. 


A number of the avionic units, located in the forward section of the aeroplane, were 
recovered. One possible object impact mark was found on top of the left engine vibration 
monitoring unit. This is located on the outboard side of rack numbered E1-4, which is 
close to the fuselage on the left hand side. 


Cargo and containers 
A number of cargo containers and their content were distributed close to the wreckage. 


2.12.2.4 Wreckage site 4 (green) 

The fuselage of the aeroplane between the wing and the tail section (section 46 to 
section 48) was primarily located in site 4, approximately 2 kilometres south, south-west 
of Hrabove. Pieces of wreckage, including both horizontal stabilizers and both wing tips 
were distributed over this site of approximately 540 x 650 metres. The site contains a 
number of farm buildings surrounded by a fence and it was partially surrounded by a 
forest which was located in a gully. The right stabilizer was found in a small lake in the 
south-easterly part of the site. An overview of the wreckage site and the location of the 
wreckage pieces is depicted in Figure 28. A total of about 50 oxygen generators were 
recovered from sites 4 and 5. 
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12. Lower fuselage below 27. Right hand fuselage 
door 4 with partial text 
13. Right hand fuselage “Malaysia” 
with door frame of door 28.Door 4R 
AR 29. Upper left hand 
14. Left wing tip fuselage 
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cone N 


Figure 28: Overview of wreckage site 4 and the location of the wreckage pieces. (Source: Dutch Safety Board) 


The numbers in brackets following the titles below correspond with their locations in the 
diagram above. 


Left horizontal stabilizer (1) 

The left horizontal stabilizer was located in the south-westerly region of site 4. The 
stabilizer impacted the ground in a slightly tilted position with the bottom side facing 
upwards. The stabilizer was relatively intact and it appeared the stabilizer had sheared 
near the stabilizer wing box. Damage was observed on the leading edge of the stabilizer. 
The elevator surface was missing. 


Upper fuselage with Emergency Locator Transmitter antenna (2) 

The top fuselage between STA1664 to STA2000 was found near a building in the south- 
westerly region of site 4. The fuselage was folded and showed three antennas on the 
exterior side of the fuselage. This included the Emergency Locator Transmitter antenna 
and the low gain SATCOM antenna. 


Right wing tip (3) 

The right wing tip was located near farm buildings in the south-westerly region of site 4. 
The wing tip was facing in a south-easterly direction and was upside down. The wing tip 
had sheared from the wing at the fourth fuel tank vent hatch, counting from the tip 
towards the root. A safety line attach point was visible on the top side of the wing tip. 
The outboard aileron was missing. 
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Small cargo door (4) 

The small cargo door belonging to the right hand side of the aeroplane was found in 
between the farm buildings. The door was tound in one piece with the exterior side 
facing upwards. The small cargo door vent, located on the upper side of the cargo door, 
was missing. The door assembly was cracked in lateral direction. 


Left and right trailing edge inboard flap (5 and 6) 

A part of the inboard trailing edge flap of the left wing and a part of the inboard trailing 
edge flap of the right wing were found in the field east of the agricultural buildings. Both 
inboard flaps had broken off in longitudinal direction revealing the inner structure on 
both sides of the flaps. 


Left hand fuselage with door 4L (7) 

Door 4L and surrounding fuselage (STA1916 to STA2174) were identified between a 
number of buildings in the central region of site 4. The door was in the closed position 
and a portion of the bottom fuselage was folded. Four window frames, including two 
window panes as well as a part of the rear pressure bulkhead were still attached to the 
fuselage. The aeroplane registration, '9M-MRD’ was visible. 


Left hand fuselage between doors 3L and 4L (8, 9 and 10) 

The left hand fuselage between doors 3L and 4L was separated in three pieces. The first 
piece (STA1546.5 to STA1622) was found in the field, close to the fence surrounding a 
number of farm buildings. The fuselage contained the right hand door frame of door 3L, 
two window frames and a portion of the wing to body faring. 


A second piece (STA1743 to STA1790) was found in the western region of site 4. This 
piece included eight window frames, with some window panes still attached. The bottom 
part of the fuselage showed a large tear in lateral direction. 


The third piece was found close to the second piece in the field, close to a fence 
surrounding tarm buildings. The fuselage (STA1790 to STA1916) contained five complete 
window frames, including two window panes. Three holes, approximately 10 by 
10 centimetre, were noted; one below the window frames and one above the window 
frames. 


Right hand fuselage with small cargo door frame (11) 

Fuselage with part of the aft side of the wing to body faring was found in the field east of 
the agricultural buildings. The fuselage contained the cargo door control switch, as well 
as the right hand side of the frame of the small cargo door. 


Lower fuselage below door 4 (12) 

Part of the lower left hand fuselage (STA1958 to STA2150) was found in the eastern region 
of site 4, in a field to the east of the farm buildings. This part contained the lower part of 
the frame of the pressure control system outflow valve and the tail strike indicator. On 
the inside, part of the cargo floor was still attached to the fuselage. 
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Right hand fuselage with door frame of door AR (13) 

The door frame of door 4R and the surrounding fuselage of the right hand side (STA1958 
to STA2129) of the aeroplane was found in the eastern region of site 4, in the field east of 
the farm buildings. The letters ‘WRD', part of the aeroplane’s registration, were visible, 
and two window frames were still attached. Although the door frame was complete, it 
had been broken in one of the lower corners, and was found in a twisted position on the 
ground. Door AR itself was found in the northern region of site 4, in the gully. On the 
lower half of the door, a perforation from the outside is visible. 


Left wing tip (14) 

The left wing tio was located near the small lake in the south-easterly region of site 4, 
with its top side facing upwards and the tip in a north-westerly direction. A safety line 
attachment point was visible on the top side of the wing tip. The tip showed signs of 
impact damage on the top side and the leading edge (see Figure 29). The wing tip broke 
off trom the wing at the fourth fuel tank vent hatch, counting from the tip towards the 
root. Several pieces of foreign objects were recovered from inside the left wing tip (one 
piece is shown in paragraph 2.12.2.8). 


- 





Figure 29: Left wing tip with impact damage near and outboard of the safety line attachment point. (Source: 
Dutch Safety Board) 


Right horizontal stabilizer (15) 

The right horizontal stabilizer was submerged in a small lake in the south-eastern region 
of site 4. The stabilizer was moved and placed near the small lake. The stabilizer had 
broken off at rib 15. The trailing edge of the right horizontal stabilizer was missing, as 
well as the tip. Parts of skin on the upper side of the stabilizer were missing. 
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Right hand fuselage between door 3R and AR (16) 

The right hand side of the fuselage between doors 3R and AR was located in the gully in 
the wooded site on the northern region of site 4. The fuselage included the aft door 
frame of door 3R, the cargo door frame and the bulk cargo door. The lower side of the 
cargo door frame and door 3R itself were missing. The cargo door was found in the 
central region of site 4, between a number of buildings. The fuselage above the windows 
was missing. No impact damage on the fuselage was observed. 


Auxiliary Power Unit cone (17) 

The Auxiliary Power Unit (APU) cone was located in the gully in the small forest in the 
northern region of site 4. The cone had broken off at STA2508 and no damage was 
observed on the exterior side of the APU cone. 


Inboard spoiler right wing (18) 

An inboard spoiler belonging to the right wing was found with the top side facing 
upwards in the field east of the agricultural buildings. The spoiler was damaged along 
the trailing edge of the spoiler assembly, revealing the internal structure. 


Left hand fuselage with partial text ‘sia’ (19) 

A portion of the fuselage of the left hand side with text ‘sia’, which is part of the ‘Malaysia’ 
logo on the side of the aeroplane (STA1014 to STA1077) was found in the tield east of the 
buildings, in the eastern region of site 4. 


Inboard spoilers left wing (20) 

Two inboard spoilers, still attached to part of the spoiler assembly, belonging to the left 
wing, were found in the gully. Both spoiler panels were damaged and a lower portion of 
the wing was still attached to the spoiler assembly. 


Right hand fuselage with partial text ‘PM-MRD’ (21) 

This part of the fuselage (STA2150 to STA2295.65) belongs to the right hand side and 
shows part of the registration ‘9’. The top side shows a mostly straight shear. Both sides 
were jagged and the bottom side is irregularly sheared. Formers and stringers, as well as 
a small part of the rear pressure bulkhead were still attached to the fuselage. Three holes 
were visible; each approximately 1 by 2 centimetre. This part of the fuselage was found 
in the north-eastern region in the field east of the buildings. 


Rear pressure bulkhead (22 and 23) 

The rear pressure bulkhead was separated into four pieces. A small portion of the rear 
pressure bulkhead was still attached to the fuselage surrounding door 4L. The largest 
piece was found in the forest in the gully in the northern region of site 4. The remaining 
part of the rear pressure bulkhead is missing. 


Left hand lower fuselage (24) 

The fuselage, belonging to the lower left hand side of the fuselage (STA1706 to STA1979) 
was found in between the agricultural buildings. The exterior side of the fuselage was 
facing upwards and a hole of approximately 10 by 15 centimetre was visible. 
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Leading edge right horizontal stabilizer (25) 
The leading edge was found, separated from the stabilizer, west of the agricultural 
buildings. The leading edge of the stabilizer was perforated from the outside. 


Left hand fuselage with partial text ‘Malaysia’ (26) 

This part of the fuselage (STA1056 to STA1371) belongs to the left hand upper side and 
shows ‘ia’, part of the text ‘Malaysia’ and was found in the field close to the fence 
surrounding the buildings. Most of the formers and some of the stringers were damaged, 
but still attached to the fuselage. 


Right hand fuselage with partial text ‘Malaysia’ (27) 

This part of the fuselage (STA909 to STA975) belongs to the right hand side and shows a 
partial ‘ay’ and contains two complete and two half window frames. The bottom edge 
shows a straight tear, the top and sides are irregular. Formers and stringers are no longer 
attached to the fuselage. This part of the fuselage was found in the gully at site 4. 


Door 4R (28) 

Passenger door 4R was found in the gully at site 4. Dents are visible on the edges of the 
door. A hole of approximately 1 by 10 centimetre is visible at the bottom side of the 
door. 


Upper left hand fuselage with horizontal stabilizer travel range (29) 

The fuselage (STA2268.25 to STA2344.5) was found east of the agricultural buildings. 
The exterior side of the fuselage was facing upwards and a part of the horizontal stabilizer 
travel range was visible. Several holes, approximately 1 by 1 centimetre, were observed. 


Door 3L (30) 
Passenger door 3L was found in the field east of the buildings. The door showed a 
horizontal fold and the frame at the back of the door is cracked at the location of the 


fold. 


Door 3R (31) 

The lower half of passenger door 3R was found in the eastern region of site 4. This part 
was no longer attached to the door assembly. The lower right hand corner was sheared. 
It was noted that, although the upper portion of the door has been recovered, its initial 
impact location is unknown. 


2.12.2.5 Wreckage site 5 (blue) 

A part of the aft section of the aeroplane, including the vertical stabilizer and the 
surrounding fuselage was located in site 5, situated approximately 750 metres south- 
west of Hrabove. Within this site, pieces of wreckage were distributed over approximately 
600 x 800 metres. Parallel to the elevated road on the west side, there were power lines. 
It was noted that one of these power lines on the west side of the elevated road had 
been clipped. An overview of the wreckage site and the location of the wreckage pieces 
is depicted in Figure 30. 
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Figure 30: Overview of wreckage site 5 and the location of the wreckage pieces. (Source: Dutch Safety Board) 


On the west side of the elevated road a burn site was identified containing the remains 
of the aeroplane’s aft section, including cabin furnishing (seats and seat tracks) and cargo. 
These wreckage pieces were damaged by fire. 


Photographic evidence and satellite imagery showed that the wreckage site was 
disturbed on 17 July 2014 and pieces of wreckage were repositioned. 


The numbers in brackets following the titles below correspond with their location in 
Figure 30. 


Vertical stabilizer (1) 

The vertical stabilizer was located on the eastern side of the elevated road with the top 
part of the stabilizer facing in south, south-westerly direction. The left side of the vertical 
stabilizer was facing upwards. The upper part of the leading edge, the horn balance and 
rudder control surface were missing. A small portion of the fuselage from the left hand 
side of the aeroplane was still attached to the vertical stabilizer. 


Horizontal stabilizer (2) 

The horizontal stabilizer front soar was detached from its housing and was situated on 
the elevated road next to the aft portion of the tail. Fragments of the right horizontal 
stabilizer were still attached to the front and rear spar of the horizontal stabilizer. The 
front part of the stabilizer box showed impact marks in a lateral direction. 


Auxiliary Power Unit firewall and surrounding fuselage (3) 

The aft section of the aeroplane which contained the Auxiliary Power Unit firewall and 
surrounding fuselage near the horizontal stabilizer and vertical stabilizer was situated on 
the elevated road. The top side of the tail section was facing downwards and the 
horizontal and vertical stabilizer were not attached to the fuselage. Fragments of the 
bottom portion of the fuselage were facing upwards. It was noted that the remainder of 
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the lower fuselage was missing. The Auxiliary Power Unit firewall was visible and the 
Auxiliary Power Unit itself was not present aft of the firewall. The portion of the tail which 
houses the horizontal stabilizer and wing box was severely damaged. The fuselage, with 
the horizontal stabilizer travel range indication on the left hand side of the aeroplane, 
was detached from the surrounding fuselage of the Auxiliary Power Unit firewall. 


Container cabin crew rest area (4) 

The container of the lower cabin crew rest area (located in cargo hold 3, between 
STA1437 and STA1538) was found approximately 150 metres west of the elevated road. 
The container had split into two and its furnishing was visible. The aft portion of the 
container was facing upwards and the forward portion of the container was facing 
downwards. Both parts of the container showed signs of damage. 


Cabin floor aft section (5) 

Remains of the aft floor section of the aeroplane were identified in the concentrated 
wreckage site on the west side of the elevated road. Some of the passengers seats were 
still attached to the floor and facing downwards. Fragments of the floor and passengers 
seats had been damaged by fire. Based on the downward facing directions of the 
passenger seats and the attachment points of the seat racks and the seats, it was 
determined that the top part of the aft section of the floor was facing downwards. 


Cargo and cargo containers 
Five cargo containers, including the aeroplane’s equipment container, were found in this 
site. The content of these containers was also found in site 5. 


2.12.2.6 Wreckage site 6 (purple) 

Wreckage site 6, situated in the south-western corner of the village of Hrabove, measured 
approximately 250 x 200 metres. Within this site, a smaller region, where a high intensity 
fire had occurred, measured approximately 100 x 60 metres. An overview of the wreckage 
site and the location of the wreckage pieces is depicted in Figure 31. 
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Figure 31: Overview of wreckage site 6 and the location of the wreckage pieces. (Source: Dutch Safety Board) 


The numbers in brackets following the titles below correspond with their location in the 
diagram above. 


All large pieces of wreckage that were located in site 6 were found in this smaller region, 
with the exception of the forward keel chord. Pieces of wreckage were distributed over 
two sub-sites, a northern and southern site, separated by an elevated road. Photographic 
evidence and satellite imagery showed that the wreckage site was disturbed on 18 July 
2014 and pieces of wreckage were repositioned. The centre section of the aeroplane, 
including parts of the wings and both engines were located on site 6. 


Another fire occurred on the corner of the residential area on the eastern side of site 6. 
Both sub-sites included vegetation, infrastructure and pieces of wreckage that showed 
signs of fire damage. A wooden fence and a haystack within this area were damaged by 
fire. 


Forward keel chord (1) 

The forward keel chord (STA888 to STA1025) was separated from the keel beam and 
facing in a south-easterly direction in the southern part of site 6. The bottom side of the 
forward keel chord was facing upwards and chord itself and parts of the wing to body 
faring were visible. A portion of the cargo rail was still attached to internal structure of 
the fuselage. 


Aft keel chord and keel beam structure (2) 

The keel beam was located on the elevated road on site 6 and showed signs of fire 
damage. The aft keel chord was still attached to the keel beam. Both wreckage pieces 
showed signs of fire damage. The bottom side of the aft keel chord was facing upwards. 
Pieces of the cargo rails were identified on the top side of the aft keel chord. 
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Wings (3 and 4) 

Most of the fragments of the wings were located in the southern region of site 6. The 
remains of the wings showed extensive fire damage. The wings were found upside down, 
as indicated by the tank hatches and their markings. 


The left wing was situated parallel to the elevated road in the south-western corner of 
site 6. The remains of the wing contained partial markings of the aeroplane’s registration; 
‘9’ and ‘M'. The tank hatches and markings were visible. The left wing near the partial 
registration was relatively intact. Further along the wing, towards the root, melted 
aluminium was observed. Based on the marking of the registration and the orientation of 
the tank hatches, it was determined that the left wing was facing in south-westerly 
direction. 


The right wing was situated perpendicular to and across the elevated road. The wing 
contained placards and markings stating ‘Fuel Tank Vent Right Wing’ indicating the right 
wing. The portion of the wing, below the tip, was relatively intact and no fire damage was 
visible. Further along the wing, towards the root, the tank hatches were no longer visible. 
Pieces of melted aluminium indicated that parts of the wing were consumed by fire. 
Based on the sequence of the tank hatches, the presence of placards, markings and tank 
hatch screws, it was determined that the right wing was facing north. 


Main landing gear legs (5 and 6) 

Both main landing gear legs were located on the elevated road with the landing gear 
bogies still attached. All the tires on the main landing gear were consumed by fire and 
the rims were visible. Photographic evidence indicated that the right hand retract 
actuator was close to its retracted (gear-up) length. 


Engines (7, 8 and 9) 

Both the left and right engines were separated from the wing and had impacted the 
ground in a slightly inverted attitude. Both fans were found detached and the fan blades 
of both engines remained in place in their discs. The engines were located in the southern 
region of site 6. 


The left engine was located near the left wing. The core of the left engine had split into 
two sections. The front part of the engine was facing north and the aft part of the engine 
was facing west. The fan blades and the intermediate compressor blades of the left 
engine showed little evidence of rotation at impact. 


The right engine was located on the south side of site 6, parallel to the elevated road. 
The core of the right engine was relatively intact with its forward side facing west. The 
right engine was located near the right wing and was separated trom the wing. 


Wing to body fairing panels (10) 

Fragments of a wing to body fairing originating from the right hand side of the aeroplane 
were identified on the south side of site 6. The exterior side of the wing to body fairing 
was facing upwards. A crack in the transverse direction was noted on the exterior side of 
the fairing. The interior side of the panel showed signs of fire damage. 
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Right hand fuselage with windows (11) 

A portion of the fuselage, containing seven passenger windows and the forward door 
frame of door 3R, was found underneath the keel beam and showed signs of fire damage. 
Below the door frame of door 3R the Ram Air Turbine actuator was identified with the 
turbine fan missing. The fuselage was deformed extensively. 


Cargo 
Fragments of cargo containers were found, but due to fire damage, none were identifiable. 


2.12.2.7 Wreckage site O (black) 

Pieces of wreckage of which the initial location could not be verified due to insufficient 
photographic and video evidence are identified as being at the so-called site 0. These 
wreckage pieces may have been moved or photographed at a different location within 
the geographic area. Primarily within the village of Petropavlivka, it is known that 
wreckage pieces were gathered near central locations such as the town hall. Some pieces 
of wreckage were collected by local residents and handed over to the Dutch Safety 
Board (Figure 32). The wreckage pieces of which the initial location is uncertain are listed 
below. 





Figure 32: Handover of the left cockpit window frame to the Dutch Safety Board by members of the SES. This 


is the same part as is shown in Figure 33. (Source: Dutch Safety Board) 


Fuselage with the lower part of a cockpit window frame 

Part of the fuselage (STA180.5 to STA228.5), originating from the left hand side of the 
cockpit, was located at the side of the road, in the central region of site 2, near the village 
of Petropavlivka. Residents of the village reported that the wreckage piece had been 
moved to expedite the search and recovery mission. The fuselage skin was punctured 
from the outside in a number of places and the outside fuselage skin was pitted and 
showed traces of soot. Frames on the inner side of the fuselage had been sheared off. 
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Figure 33: Part of the left cockpit window frame. (Source: Dutch Safety Board) 


Cockpit window left hand side 

One of the layers of the window (window number 2) on the left hand side of the cockpit 
was collected by local residents. Cockpit windows are made of multiple layers of glass 
and plastic. The window had a total of 102 puncture holes and marks, varying in size and 
shape, as seen in Figure 34. Parts of the window frame were still attached to the window. 
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Figure 34: Left cockpit window 2. (Source: Dutch Safety Board) 
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The left nose landing gear door 

Photographic evidence indicated that the left nose landing gear door had been placed 
in tront of the village hall in Petropavlivka in site 2. Nose landing gear related components 
were all identified within or close to site 3. This included the nose landing gear itself and 
the right nose landing gear door. 


The rudder horn balance 

A portion of the rudder horn balance was photographed for the first time on site 4 during 
the recovery mission of the Dutch Safety Board in November 2014. Prior to this mission, 
no photographs of this part were available. 


Lower part doorframe door 2L and surrounding fuselage 

This part of the fuselage (STA655 to STA825) was collected for the Dutch Safety Board by 
local residents. Its initial location is unknown. The lower part of the doortrame of door 2L 
is still attached to the fuselage. Furthermore, the fuselage contains three static ports and 
a light bulb. 


Frame of left hand side negative pressure relief vent 

This part of the fuselage contains the complete, but broken frame of the forward negative 
pressure relief vent on the left hand side (STA788.5 to STA825) and is partially wrinkled. 
The vent itself is missing. The initial location of this part is unknown. 


Left hand fuselage with partial text ‘Malaysia’ 

A part of the fuselage with letters from the operator’s name, located between STA846 
and STA1035 were recovered. Parts of some of the window frames were attached. The 
fuselage skin was torn and many stringers on the rear of the fuselage skin were missing. 
The initial location of this part is unknown. 


Left hand fuselage cockpit with pitot tube 
This part of the fuselage (STA180.5 to STA212.5) contains the left pitot tube and the left 
ice detector. Impact damage is visible on the upper part and the sheared edges are 


jagged. 


Right hand fuselage with partial text ‘Malaysia’ 

This part of the fuselage contains the top part of the text ‘Malaysia’ on the right hand 
side of the aeroplane (STA846 to STA1032) and was identified in site 1. All edges show 
clear shears. Halfway, the fuselage is partially sheared from top to bottom. Formers and 
stringers were no longer attached to the fuselage. 


2.12.2.8 Other relevant objects recovered 

During the recovery of the wreckage, a number of parts that did not originate from the 
aeroplane and its content were found in the wreckage area. The parts found appeared to 
be connected with a surface-to-air missile. The parts that were suspected to be related 
to a surface-to-air missile were transported to the Gilze-Rijen Air Force Base in the same 
way as the aeroplane wreckage was. On arrival the parts underwent the same examination 
as the pieces of aeroplane wreckage. Subsequently the parts that were suspected to be 
related to a surface-to-air missile were subjected to forensic examination, as part of the 
criminal investigation (see Section 2.16). In order to not risk impeding the criminal 
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investigation, the Dutch Safety Board has decided not to publish images of all of the 
recovered fragments that were presented to the Annex 13 partners during the progress 
meeting in August 2015. Images of three of the parts are shown in Figure 36. 





Figure 35: Image of 9M38M1 surface-to-air missile showing the approximate location of three of the parts 
recovered. (Source: NBAAI) 


The shape and form of the parts recovered is consistent with a 9M38 series surface-to-air 
missile. Images of three of the recovered parts are shown in Figure 36 together with an 
indication of origin on a 9M38 series surface-to-air missile; namely an engine nozzle (1), 
part of one of the four stabilizer fins (2) and a data cable (3). 
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1. Rear nozzle of the missile’s engine. (Source: Missile engine nozzle as found in Ukraine. (Source: 
NBAAI) Dutch Safety Board/Dutch National Police) 





| 


Part of stabilizing fin during identification at 





Gilze-Rijen Air Force Base. (Source: Dutch Safety 
Board/Dutch National Police) 





3. Data cables as mounted under the stabilizing Data cable during identification at Gilze-Rijen Air 
fins. (Source: NBAAI) Force Base. (Source: Dutch Safety Board/Dutch 


National Police) 


Figure 36: Weapon parts recovered. The parts are shown with sample photos showing their origin on a 


9M38M1 surface-to-air missile. Numbers correspond with numbers in Figure 35. 
In addition, several fragments were recovered from the wreckage of the cockpit and from 


the left wing tip that did not belong to the aeroplane or to its contents. Two of those 
fragments are described in paragraph 2.16.3 and shown in Figure 40. 
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Summary of the wreckage information 


e Within the geographic area, approximately 50 km?, six sites with wreckage were 

identified. These sites were located west and south-west of the village of Hrabove. 
e The distribution of wreckage pieces over a large area indicates an in-flight break-up. 
e Site 1 is north of the village of Petropavlivka which is situated 8.8 kilometres west 


of Hrabove. Site 2 covers a large part of the village of Petropavlivka, situated ae 
8 kilometres west of Hrabove. Site 3 is the southern corner of the village of 


Rozsypne, 7 kilometres south-west of Hrabove. ae 
Yaa -Loa tT) 


e Pieces of wreckage originating from section 41 and 43 of the aeroplane were si asta ee 


found in site 1, 2, and 3. The top portions of the fuselage of section 41 were 
mostly located in site 1. Parts of the fuselage originating from section 43 were 
mainly found in site 2. The fuselage of the cockpit and cockpit interior were 
primarily located in site 3. 

e Site 4, located 2 kilometres south, southwest of Hrabove was adjacent to site 5, 
located 750 metres south of Hrabove. Site 6 was located in the south-westerly riers ~~ 
corner of Hrabove. laa 

e The mid and aft sections of the aeroplane were distributed over sites 4, 5 and 6. 
Site 4 contained mostly pieces of wreckage originating from section 44, 46 and 
47. Both wing tips and both stabilizers were also found in this site. In site 5, pieces 
of section 48 were found, including the vertical stabilizer. This site was partially 
subjected to fire. Both the wings and engines were found in site 6. Parts of the 
aeroplane in this site were damaged or consumed by fire. 5 Saeed es 

e A few hundred holes and ricochet marks were found in the forward fuselage. 
Over a dozen holes and marks were found in the left engine intake ring and the 
left wing tip. 

e A number of parts were found that were not part of the aeroplane’s wreckage 
but were considered to be related to the crash. These parts appeared to originate 


from a 9M38 series surface-to-air missile. la ae 
. a . 7 Flying over 
e Some pieces of wreckage that were identified as having been in the wreckage ae 


area shortly after the crash were not found during the recovery missions. 


2.13 Medical and pathological information 


Part B: 


9 Assessing the 
2.13.1 General TELS: 
The identification of the human remains began in Donetsk, Ukraine the day after the 
crash. After registration, the pathologist of the mortuary opened files for the human 
remains, took photographs, wrote descriptions and took DNA samples. At the time an 
autopsy was performed on one of the bodies. A section of rib was removed from eleven 
of the bodies.'’ This was tor DNA examination as part of the identification process and is Fe 
the common local working method. Subsequently the decision was made to perform the Recommendations 
identification process in the Netherlands. 





13. LTFO employees and their international colleagues have informed the relatives involved about this matter. 


p So Of 277 13 
— a y - List of appendices 





The human remains, including the DNA material, were taken to the Netherlands for 
identification. Fragmentation, fire and decomposition explain why little or no human 
remains were found for some of the passengers. 


As part of the identification and forensic investigation, before the body bags containing 
human remains were opened in Hilversum, the Netherlands and the remains were visually 
examined, an X-ray or CT scan was made of all of the body bags received. The scans 
revealed foreign objects both in and on some of the human remains. Most of the foreign 
objects were (later) identified as: 


° personal belongings (medical implants, rings, coins, telephones, zips on clothing, etc.); 

e objects originating from the aeroplane (such as seat belts, fragments of seats, parts 
of the fuselage), or 

° objects that stem from the ground (stones, coal particles, etc). 


Objects that did not have a readily identifiable source, were removed and sent to the 
Netherlands Forensic Institute (NFI) for further examination. Once the metal fragments 
had been removed, the human remains were released for identification. The identification 
of the human remains, both of the victims with the Dutch nationality and of the victims 
with other nationalities, was carried out by a team consisting of 120 forensic specialists 
from the National Forensic Investigations Team (LTFO) from the Netherlands and 80 
forensic specialists from Australia, Belgium, Germany, the United Kingdom, Indonesia, 
Malaysia and New Zealand. 


The relatives were informed by the authorities of their respective countries about the 
identification process of their family members and all related actions. Once they had 
been identified, the human remains were handed over to the relatives. 


2.13.2 Crew autopsy 

Following a request from the public prosecutor four bodies, that were suspected to be 
those of crew members, were selected for further investigation. These were provided to 
NFI for a detailed autopsy and toxological examination. 


The findings were as follows: 


e First Officer Team A: The First Officer was found with a four-point harness on and had 
an epaulette worn by a First Officer. The post-mortem examination revealed that this 
crew member sustained multiple fractures of the skull, spine, pelvis, ribs, arms and 
legs. In this body, an aeroplane part identified as belonging to the right hand side of 
the aeroplane, was found during the post-mortem examination. During the body scan 
of the First Officer’s body, over 120 objects (mostly metal fragments) were detected. 
The majority of the fragments were found in left side of the upper torso. 

e Purser: More than 100 objects were detected. The scatter pattern that the fragments 
formed was uniform and comparable with the pattern of the First Officer. 

e Captain Team B (non-operating flight crew): Three metal fragments were detected by 
means of X-ray examination. Two of which were identified as surgical clips. The third 
fragment was found not to be present inside the boay. 
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e Cabin crew member: This person had sustained relatively few injuries and no metal 
fragments were found other than a medical implant. 


Following identification, it was found that the body of the Captain from Team A was not 
one of the four bodies that underwent detailed examination. The body of the Captain 
from Team A had undergone an external and internal examination to remove foreign 
objects. This examination showed a great deal of fragmentation in the body. In addition, 
hundreds of metal fragments were found. Several bone fractures and other injuries that 
were observed in the Captain's body were judged to be related to the impact of metal 
fragments travelling at a high velocity. 


Summary of the autopsy results of the crew members in the cockpit 


The Captain and First Officer from Team A and the Purser sustained multiple fatal 
injuries associated with the impact of metal fragments moving at high velocity. 


2.13.3 Toxicological examination of crew members 

Samples were collected for toxicological examination from the four bodies during the 
post-mortem examination. At that time, these bodies were presumed to be four possible 
flight crew members. The results of the identification process determined that one of the 
bodies was that of the First Officer, trom Team A, who was operating the aeroplane at 
the time of the crash. The toxicological examination was performed by the NFI. 


For the First Officer’s body there were no indications of the presence of medicines 
(including sedatives), drugs or pesticides in the boay. In the First Officer’s body, traces of 
ethanol and metabolites of ethanol (Ethyl Glucuronide and Ethyl Sulphate) were found in 
liver and muscle tissue. Ethanol may have been formed, in whole or in part, post-mortem. 
There is insufficient research data available on these metabolites in liver and muscle 
tissue to interpret this finding. No blood was available for toxicological analysis as a result 
of post-mortem change. 


Summary of the toxicological examination 


e No traces of medicines, drugs or pesticides were found in the body of the First 
Officer from Team A who was at the controls of the aeroplane at the time of the 
crash. Traces of ethanol and its metabolites were found in liver and muscle tissues 
which may be formed, in whole or in part, post-mortem. 

e No blood was available for toxicological analysis as a result of change post- 
mortem. 


2.13.4 Medical examination of other crew members and passengers 

Remains from all but two passengers were found, enabling them to be identified during the 
identification process. It is noted that only a few foreign objects were present, identified 
and extracted for further examination from the bodies of the passengers (See Section 2.16). 
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The bodies in the fuselage section forward of the wings and in the fuselage section aft of 
the wings were largely intact. Radiographic examination and CT scans of these bodies 
showed multiple fractures and/or crushing. It proved impossible to determine when 
these injuries were sustained. Because of the severity of the injuries resulting from the 
impact on the ground, any injury sustained earlier could not be distinguished. How many 
passengers had already died before the impact on the ground could not be determined. 


The centre section of the aeroplane was severely damaged and burnt. This was the 
section of the aeroplane that landed upside down and was consumed by tire after 
impacting the ground. The majority of the human remains from this section of the 
aeroplane were fragmented and/or burnt. The injuries of most of the passengers from 
this section of the aeroplane could not be assessed with the CT images. 


The scans showed metal fragments in the bodies of a large number of occupants. 
Research showed that these fragments included medical implants, jewellery and objects 
that originated from within the aeroplane. 

In view of their positions in the aeroplane, the crew members (other than those who were 
seated in the cockpit) are expected to have suffered the same fate as the passengers. 


Summary of medical examinations of passengers and crew 


The majority of the occupants seated in the cabin suffered multiple fractures 
consistent with the in-flight disintegration of the aeroplane and ground impact. 


2.14 Fire 


No indication was found of the ignition or proliferation of an on-board fire prior to the 
aeroplane breaking up in flight. 


Wreckage site 6 contained evidence of a large fire that consumed much of the centre 
section of the aeroplane. The two main landing gear legs and the centre wing box 
showed fire damage. In addition, the engines showed signs of partial exposure to a fire. 
A second, smaller, fire was found to have burned near the location of the auxiliary power 
unit firewall at wreckage site 5. 


Summary of fire information 


There was no in-flight fire before the in-flight break-up. Fires erupted at two 
wreckage sites after the crash. 
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2.15 Survival aspects 


2.15.1 Search and Rescue 

The local Ukrainian State Emergency Service (SES) recovered human remains between 
17 July and 21 July 2014. The SES is a federal organisation which has local teams that, 
among other things, are responsible for the protection of the population in case of 
disasters. When a disaster occurs, the SES is given authority over other services. In the 
case of flight MH17, the SES was assisted in the recovery by local fire brigades, police, 
farmers and miners. Hundreds of Ukrainians were involved.'* 


Flight MH17 crashed in an area where an armed conflict was ongoing. Because of this, 
part of the area where aeroplane wreckage and bodies had come down was difficult to 
access during the first period. Initially, due to the conflict, it was not possible for Dutch 
and other foreign experts to enter these areas because of the assessed safety risks. 


On 17 July, the pathologist of the mortuary in Donetsk went to the villages of Rozsypne 
and Petropavlivka’? where bodies had come down. From there, he directed the recovery 
of these bodies. A total of 37 bodies was transferred to the mortuary in Donetsk, where 
the identification process began. When it became apparent how many bodies had to be 
recovered, the mortuary was ordered by the Ukrainian government as well as by the anti- 
government groups to adopt a different working method. From then on, the bodies were 
collected in a refrigerated railway carriage in Torez and then transferred to Kharkiv. The 
37 bodies that were originally brought to Donetsk were also transferred to Kharkiv. 


In Kharkiv, an international team led by experts from the Netherlands organised the 
preparations for transporting the human remains to the Netherlands. The preparations 
were carried out in a factory building that had been made available for this purpose. 


The first reconnaissance missions involving Dutch nationals took place on 20 and 21 July. 
The Dutch team observed that there were no more human remains visible at the locations 
accessible to them. It can therefore be concluded that the SES had thoroughly searched 
the locations that were accessible during the first days.'° 


After the initial recovery in July 2014, international follow-up missions took place in 
November 2014, March 2015 and April 2015.'’ During these follow-up missions, human 
remains were found that had not been accessible or immediately visible during the first 
period. During the last mission, the soil was excavated at the site where the centre 
section of the aeroplane had crashed, which was where the largest tire had occurred. 
More human remains were discovered there. 


14 — http://www. rijksoverheid.nl/nieuws/2014/08/09/viiegramp-mh17-waar-heeft-de-missie-gezocht.html, consulted on 
15 July 2015. 

15 These were two of the six crash sites. 

16 See also: http://www.rijksoverheid.nl/onderwerpen/vliegramp-mh17/nieuws/2014/08/06/persconferentie-rutte- 
over-terugtrekken-missie-uit-rampgebied-mh17.html. 

17 The website http://www.rijksoverheid.nl/onderwerpen/vliegramp-mh17/nieuws includes an overview of all 
activities with regard to the transferral of human remains and belongings. Information can also be found at: 
https://www.politie.nl/themas/flight-mh17%5B2%5D/qa-vlucht-mh17.html. 
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2.15.2 Data carriers 

No photographs or (text) messages from occupants were found on personal data carriers 
such as mobile phones that were taken after the impact of high-energy objects. In total, 
407 personal data carriers were found. The condition of 54% of the data carriers found 
was adequate for the NFI to further examine the data stored. The other 46% was too 
badly damaged to be examined. 


Summary of survival aspects 


The human remains and bodies were initially recovered by the local State Emergency 
Service. The organisation received assistance from local fire departments, 
emergency services, police and locals. 


2.16 Tests and research 


During the examination of the wreckage parts at Gilze-Rijen Air Force Base and the 
forensic examinations in Hilversum fragments were safeguarded and further examined 
by the Netherlands Forensic Institute (NFI). This work is described in the following 
paragraphs. 


2.16.1 Forensic examination 

In the course of the investigation, hundreds of fragments were found in the wreckage of 
the aeroplane, the remains of the crew members and passengers. Some of the fragments 
were found to be aeroplane parts, some were identified as personal belongings and 
other fragments originated from the ground. 


A distinct group was identified as small pieces of metal that were suspected to be high- 
energy objects, or parts of them. These fragments were extracted from the Captain from 
Team A, the First Officer from Team A, the Purser, who was present in the cockpit at the 
time of the crash, and from the cockpit wreckage (Figure 37). These fragments were 
found to be ferrous. 
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Figure 37: Four distinctly shaped fragments. Top left: cockpit. Top right: Captain’s body. Bottom left: Purser’s 
body. Bottom right: First Officer’s body. (Source: NFI). Scale is in millimetres. 


Further forensic examinations were conducted on a number of these fragments. The 
selection was based on size, shape, mass and ferrous properties. In total 72 fragments 
were selected for further examination. Fifteen of these 72 fragments were found in the aes 

7 Flying over 
remains of the three crew members, one was found in the body of a passenger. The ae 
remaining 56 foreign fragments were recovered from the wreckage. 


2.16.2 Examination of the selected fragments 

The origin and the elemental composition of the selected fragments, together with 
21 reference fragments (e.g. aeroplane metal structure, cockpit glass) were examined by ee 
the NFI using a scanning electron microscope and energy dispersive X-ray analysis (EDX) 9 Assessing the 
system. Further examinations were conducted on cross-sections of the fragments by oe 
using a Focused lon Beam (FIB). 


The elemental composition of these fragments was determined qualitatively and it was 
found that 43 of the 72 examined fragments consisted of unalloyed steel. The fragment 
obtained from the passenger was found to be non-metallic (coal-slag) and the others Fe 

were made of stainless steel. Recommendations 


On 20 of the selected fragments of unalloyed steel, aluminium and/or glasslike deposits 
were present. On 14 of these fragments, the glass deposit consisted of sodium, 
aluminium, silicon, oxygen, and zirconium. 
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Cross-sections were made using the FIB technique on fragments recovered trom the 
remains of the crew members, that had a glass and/or aluminium deposit. Scanning 
electron microscope examinations of the cross-sections created showed that both the 
aluminium and glass deposits were present in the form of thin layers of re-soliditied 
material. These layers have a thickness ranging from tenths micrometres to tens of 
micrometres (Figure 38). On a small number of fragments thin layers containing traces of 
copper and plastic were found. 





Figure 38: Example of SEM examination on a cross-section made using FIB. Note: 1) Layer of platina deposited 


by NFI, 2) layer of re-solidified molten cockpit glass, 3) unalloyed steel. (Source NFI) 


The elemental composition of the aluminium traces found were consistent with the 
elemental composition of the aluminium obtained from the aeroplane as reference 
material. The investigation did not analyse each trace of aluminium to identify which 
aluminium alloys were present. 


The glass deposits present on the surface of the 14 fragments had an elemental 
composition of sodium, aluminium, silicon, oxygen and zirconium. This composition 
corresponds to that of cockpit window glass from a reference piece held by the NFI and 
with the cockpit glass obtained from the wreckage. The other pieces of glass that were 
secured from the wreckage contained no zirconium. It is noted that common types of 
glass, such as window glass, car windscreen glass and glass on mobile telephones do not 
contain zirconium. 


The examination further showed that several fragments recovered from the crew 
members (Figure 39) were heavily deformed on one side of the fragment and that the 
opposite side was only slightly deformed. The deposits that were detected were mainly 
found on the heavily deformed side of the fragments in a re-solidified state. 
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Figure 39: Micro CT-images of the fragments (shown at the right side of Figure 37, left from the First Officer’s 
and right from the Captain's body) show the deformation of the fragments. (Source: NFI) 


The investigation concluded that these fragments impacted the aeroplane at a very high 
velocity, thereby deforming the object at the side of the impact. The consequential 
frictional heat melted the aeroplanes materials (glass, aluminium etc.) and a thin layer of 
solidified aeroplane material was deposited to the heavily deformed side of the object. 
Although the velocity of the object was reduced due to the impact with the aeroplane, 
the object continued its path and then impacted the crew member where it was found. 
These fragments were as such assessed to be high-energy objects. 


The chemical composition of 20 selected fragments which had either a very distinctive 
shape (including the two bow-tie shaped pre-formed fragments) or a layer of deposits or 
both was determined. This was determined by means of laser-ablation inductively 
coupled plasma mass spectrometry. 


A comparison between the fragments and their composition was made using a statistical 
analysis method called Principal Component Analysis. The analysis showed that the 
20 selected fragments from the wreckage and the remains can be divided in two 
distinctive groups. Within such a group, no statistical difference could be determined 
between the fragments, indicating that the fragments originated from the same source. 
In other words, the fragments within a group were made from the same unalloyed steel 
base material (i.e. the same plate). One of the analysed fragments could not be linked to 
a distinctive group. 


The result of the Principal Component Analysis was that from the 20 selected fragments, 
19 fragments were assessed to be high-energy objects; 8 originated from the flight crew 
and 11 from the wreckage. A summary of the results is given in Table 11 and Table 12. 
One fragment not linked to either of the two distinctive groups above was concluded to 
be a high-energy object as well. This conclusion was drawn primarily on the basis of the 
fragment’s shape (a deformed cubic form) and the presence of a similar glass deposit on 
the fragment. 
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The examinations showed that one further fragment, not included in the Table 11, that 
was obtained from a passenger was found to be coal slag. 





Location Shape and dimensions Mass Group (see below) 
(millimetres) (grams) 
1 - = 2 






Document binder 

2 Document binder - - aoe 
3 Cockpit Irregular, - 49 

. eae 
4 Cockpit Irregular, - 1.3 ere 

Taielaaarenetodal 
5 Cockpit Irregular, - 2:5 
6 Cockpit Irregular, - 1.1 
i, Wreckage Irregular, - 3.2 
8 Wreckage Irregular, - 2.7 rey 
Introduction to 
9 Wreckage Irregular, - 0.8 eto > 
10 Cockpit Bow-tie, 14x 14x 4.5 6.1 
11 Cockpit Irregular, - 2) 
12 Human remains Irregular, - 25 
lah 
iS Human remains Irregular, - 0.1 Bee 
14 Human remains Irregular, - 0.1 
15 Human remains Cubic,6x6x5 es 
16 Human remains Irregular, - 1.5 
17 Human remains Irregular, - ae laa 
7 Flying over 

18 Human remains Irregular, - 16 velin: 
19 Human remains Culsie, 12121 1.2 
20 Human remains Bow-tie, 12x 12x5 5./ 








Table 11: Overview of the 20 selected fragments. 


The elemental composition of the two groups in the column of Table 11 is shown in 
Table 12. 
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S 
: 2 z 

3 E : a ® 

O = oD re wD 

i : : = 3 

© 

$ rs > S = 

SS SS Ss Ss SS 
1 0.0021 0.060 0.4619 | 0.0083 0.063 0.141 0.0058 0.0014 
D 0.0010 0.134 0.4170 0.0133 0.119 0.241 0.0072 | 0.0021 


Table 12: Composition in (percentage) of elements found in steel of the two groups of fragments examined. 


2.16.3 Explosive residue and paint analysis 

In addition to the examination described above, as part of the criminal investigation, 
126 swab samples were taken on various locations of the wreckage of the aeroplane and 
one of the missile parts in paragraph 2.12.2.8 and analysed by the NFI for the presence 
of explosive residues. 


Approximately 30 of the 126 swab samples showed traces of mainly two different 
explosives; the nitroamine RDX and trinitrotoluene (TNT). A few of the 30 samples 
showed traces of PETN. On the tested missile part traces of RDX was found. On the 
missile part TNT or PETN could not be identified. 


The investigation into the origin of the explosive residues was made more complicated 
as the objects from which the swab samples were taken had been exposed to the 
elements for a long period of time. The possibility of contamination during transport and 
by the fact that the wreckage lay in an area of armed conflict is a concern for the explosive 
residue analysis. 


One of the fragments that was recovered from the wreckage of the aeroplane, was found 
in the left wing tip and a second one was found lodged in the left cockpit window frame. 
Figure 40 shows images of both of these fragments. 
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Metal fragment recovered from inside the left wing Location of the mew inside the left wing tip, 
tio. (Source: Dutch Safety Board/Dutch National seen from below. (Source: Dutch Safety Board) 
Police) 





Metal fragment recovered from the left cockpit Location of the fragment in the left cockpit 
window frame. (Source: Dutch Safety Board/ window frame. (Source: Dutch Safety Board) 
Dutch National Police) 


Figure 40: Two of the metal fragments recovered from the aeroplane wreckage. 


A number of paint samples taken from these metal fragments recovered from the 
aeroplane and missile parts recovered at the wreckage area (see Figure 36 and Figure 40 
and in paragraph 2.12.2.8) were compared. 


The colour and build-up of the paint layers was visually examined and the chemical 
composition of the paints were analysed using Fourier-transform infra-red spectrometry. 


The missile parts found at the wreckage area and the fragments recovered from the 
wreckage were painted with the same number of paint layers and had the same colour. 
Furthermore, the chemical composition (as analysed using Fourier-transform infrared 
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spectroscopy) of each paint layer was identical for the samples analysed. It was concluded 
that the paint samples taken from missile parts could not be distinguished from those 


found on foreign objects extracted from the aeroplane. 


The results of these analyses were provided to the Dutch Safety Board by the public 


prosecutor. 


Summary of forensic investigation 


Over 500 fragments were recovered from the wreckage of the aeroplane, the 
remains of the crew members and passengers. Many of the objects were 
identified as personal belongings, aeroplane parts or objects that originated 
from the ground after impact. In addition, many of the objects were metal 
fragments that were suspected to be high-energy objects, or parts of them. 
From the second group of objects, 72 fragments that were similar in size, mass 
and shape were further investigated. 

43 of the 72 fragments were found to be made of unalloyed steel and four of 
these fragments, although heavily deformed and damaged, had distinctive 
shapes; cubic and in the form of a bow-tie. 

On 20 of 43 fragments made of unalloyed steel, a thin layer of re-solidified 
aluminium and glass was detected. These fragments were found both in the 
remains of crew members and in the cockpit area of the wreckage. No unalloyed 
steel fragments were found in the remains of the passengers. 

The elemental composition of the re-solidified glass was compared with the cockpit 
glass and was found to match. Likewise, the elemental composition of the aluminium 
deposits matched the composition of the aluminium used in the aeroplane. 
Deformation and abrasion of the fragments was caused by the impact of the 
fragments with the aeroplane at very high velocity. The consequential frictional 
heat resulted in the formation of a thin layer of re-solidified aeroplane material on 
the fragment. These fragments were as such assessed to be high-energy objects. 
Some of the recovered aeroplane wreckage parts and one of the missile parts 
recovered showed traces of explosive residues. 

Paint samples taken from missile parts found in the wreckage area match those 
found on foreign objects extracted from the aeroplane. 


2.17. Organisational and management information 


Factual information and the analysis related to the decision-making processes around 
the flight routes are contained in Part B of this report entitled ‘Flying over conflict zones’. 


The following subjects relevant to this crash were investigated: 


e The decision-making with regard to flight routes by Malaysia Airlines, with particular 


emphasis on the route across Ukraine; 
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e The management of airspace in Ukraine, with particular emphasis on the restrictions 
of airsoace promulgated by the Ukrainian authorities. 


2.18 Additional information 


This paragraph contains a number of relevant subjects that have not been addressed 
elsewhere in Section 2. These relate to: 


e the pressure cabin and the cabin emergency oxygen system; 

e background information on possible external sources of damage to the wreckage 
parts; 

e the safety actions taken following the crash. 


2.18.1 Pressure cabin 

Crashes in the past have shown that an in-flight break-up can occur following the sudden 
failure of a pressurised cabin. Therefore, information relating to the functioning of the 
pressure cabin were reviewed. Malaysia Airlines provided a list of mandatory occurrence 
reports for the aeroplane that was involved in the crash, reflecting the period between 
delivery in 1997 and November 2013, none of which related to the functioning of the 
pressure cabin. 


Maintenance information from Malaysia Airlines for the period between November 2013 
and 17 July 2014 did not reveal any tail strike occurrences or damage to the rear bulkhead. 


A review of the entries in the aeroplane technical log (ATL) in the period from November 
2013 to July 2014 showed write-ups of buzzing or whistling noises emanating from the 
seal of two cockpit windows and one cabin door. Repairs to the seals had been made 
and annotated in the log. 


Technical information provided by Malaysian Airlines indicated that repairs to the 
fuselage skin in Section 46 had been carried out in 2012 and 2013 due to corrosion. The 
repaired fuselage skin panel was recovered with all of the repair still in place. 


A Service Bulletin had been issued by Boeing (reference number 777-53A0068) to 
address the risk of a fuselage skin rupture in the SATCOM antennae area which could 
result in a depressurisation of the cabin. The Service Bulletin was made mandatory by 
the Federal Aviation Administration who issued Airworthiness Directive 2014-05-03. The 
Service Bulletin was not applicable to the aeroplane that crashed. This issue is explained 
in more detail in paragraph 3.2.2. 


2.18.2 Emergency oxygen system description 

Emergency oxygen for the flight crew is stored in oxygen bottles installed below the 
cockpit. Oxygen is supplied as soon as the flight crew don their masks, irrespective of 
the cabin pressure. Entries in the ATL made by ground engineers from Malaysia Airlines 
showed that the oxygen bottles had been replenished on a regular basis in accordance 
with standard maintenance practices. 
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The Boeing 777 is equipped with a cabin emergency oxygen system consisting of 
chemical oxygen generators with masks that are stored above the seats. Each passenger 
seat, cabin attendant seat, toilet and crew rest berth have masks, including additional 
masks for infants travelling in the lap of an adult passenger. 


The emergency oxygen masks can be deployed manually by pushing the ‘PASS OXYGEN’ 
switch in the cockpit on the pilot’s overhead panel. The masks will be deployed 
automatically, when the cabin pressure altitude exceeds 13,500 feet. In the event of a 
sudden loss of pressurisation, e.g. a depressurisation, the masks will deploy according to 
the aeroplane manufacturer, with a time delay of a few seconds. Sometimes masks 
deploy unintentionally, when the passenger service unit (PSU) is exposed to a heavy 
shock or distortion of its container; for instance after a hard landing. 


When the emergency oxygen masks are deployed, either manually or automatically, 
internal software logic to the Electrical Load Management System will result in an activation 
signal to open the passenger service units above each block of seats. The system logic has 
an in-built delay for the activation signal. The signal activates the solenoid switch of the 
passenger service units. The activated solenoid switch withdraws a latch pin in the door 
panel of the passenger service unit, allowing it to open, followed by the masks falling out. 


The chemical oxygen generators are fired by a downward force being applied to the 
mask. The application of this force results in the attached lanyard pulling out the firing 
pin, which in turn allows the mixing of chemicals in the generator. This mixing of chemicals 
starts a chemical reaction that provides a high concentration of oxygen starting to flow 
to the mask via a hose for about 10 to 20 minutes. 


The aeroplane manufacturer stated that the Electric Load Management System non- 
volatile memory does not record a signal as to whether or not the Electrical Load 
Management System has activated the emergency passenger oxygen system, so as to 
deploy the masks. The Flight Data Recorder does not record information regarding the 
activation of the emergency oxygen system. However, in the event of activation this will 
generate a Master Caution warning. The Master Caution warning and the cabin pressure 
altitude are both recorded. The recorded cabin pressure altitude during cruise flight up 
to the moment that the Flight Data Recorder stopped recording was 4,800 feet and there 
were no warnings recorded. 


According to the aeroplane manufacturer, the operator can choose whether or not to 
store the signal that activates the emergency oxygen system on the Quick Access 
Recorder (QAR), if installed. The aeroplane did have a QAR installed which was not 
recovered from the wreckage site. Malaysia Airlines provided QAR data from earlier 
flights to show that the failure of the pressurisation of the cabin pressure system and 
cabin pressure altitude warning were recorded, but not the actual activation of the 
emergency oxygen system. 


During the investigation about fifty chemical oxygen generators were recovered from 
the wreckage sites. With the exception of one, none of the chemical oxygen generators 
had its firing pin in place and all displayed a black coloured stripe; an indication that the 
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generators had been fired. An example of one of the chemical oxygen generators found 
and a part of its passenger service unit is shown in Figure 41. 





Figure 41: Chemical oxygen generators and part of the passenger service unit. (Source: Dutch Safety Board) 


Some chemical oxygen generators were attached to their passenger service unit; others 
were found separated. All of the chemical oxygen generators were damaged and most 
of them were heavily distorted. About a dozen of the plastic PSU containers, or a part of 
them, which normally contain the emergency oxygen masks, were found. The containers 
are relatively rigid, but may nevertheless be deformed. The containers were heavily 
damaged, incomplete or cracked. All the latches, which cover the masks and keep them 
stored in the container, were missing. All of the solenoid switches were found in the 
‘unlatched’ position. A few switches were damaged and could not be reset in the ‘latched’ 
position. For most of the chemical oxygen generators recovered, the masks and oxygen 
supply tubes were missing. 


The chemical oxygen generator which had a firing pin installed originated from a crew 
rest area, which has a different stowage construction to the ones in the passenger service 
units. The stripe on this chemical oxygen generator was orange/red, indicating that the 
generator had not been fired. The latch was found separated from the plastic box and 
the corresponding frame of the latch box was cracked. The solenoid switch was found in 
the unlatched position and its lever was heavily distorted and could not be reset to the 
‘latched’ condition. The two emergency oxygen masks and the oxygen supply tubes in 
this unit were found intact. 















Figure 42: Emergency oxygen mask found on passenger. (Source: Dutch Safety Board) 


During the victim identification process in the Netherlands, one passenger was found 
with an emergency oxygen mask, see Figure 42. The strap was around the passenger's 
neck and the mask was around the throat. No information was available about how this 
passenger was found at the wreckage site. The NFI examined the mask for biological 
traces and performed DNA tests. No DNA profiles could be obtained from the five 
samples taken. Therefore, DNA analysis was not possible. The lack of DNA material can 
be explained by the mask having been left outside for a long time at high temperatures. 


There were no useable fingerprints found on the mask. The high temperatures may have 
caused the quality of fingerprints on the mask to deteriorate. 
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Summary of emergency oxygen system 


e The emergency oxygen masks can be deployed manually at any time by the 
flight crew. During flight, the masks are deployed automatically, without an input 
from the flight crew, when the cabin pressure altitude exceeds 13,500 feet. 

e The flow of oxygen through the mask starts when the firing pin is removed by the 
application of a downward force on the lanyard attached to the firing pin and the 
oxygen mask hose. 

e About fifty fired chemical oxygen generators were recovered. One, unfired, 
chemical oxygen generator was found in a crew rest area. 

e Accabin pressure altitude of 4,800 feet was recorded on the Flight Data Recorder 
during cruise flight up to the moment that the Flight Data Recorder stopped 
recording. 

e There was no data recorded regarding the activation of the emergency oxygen 
system on the Flight Data Recorder. The Quick Access Recorder, a potential 
source of data, was not recovered. 

e One passenger was found with an oxygen mask. DNA analysis was not possible. 


2.18.3 External sources of damage 

In Section 3.5 a number of scenarios are analysed that relate to the possible source or 
sources of the objects that perforated the aeroplane. These include meteor and space 
debris. A number of military systems as possible sources of damage were also considered. 
These are, for better readability, described in Section 3.6 of this report. This paragraph 
provides factual background information on meteor strikes and the re-entry of space debris. 


2.18.3.1 Meteor 

The investigation considered the possibility of a meteor as being the cause of the crash 
and sought information from the Royal Dutch Society for Weather and Astronomy 
(Koninklijke Nederlandse Vereniging voor Weer- en Sterrenkunde). The passage of a 
meteor through the upper atmosphere (from 110 down to 15 km above the earth's 
surface) is associated with distinct, measurable sound waves as it decelerates to speed 
below that of the speed of sound. These sound waves, at a frequency outside the range 
of the human ear, are known as ‘ultranoise’. 


The Royal Dutch Society for Weather and Astronomy confirmed that no such sound 
waves were recorded in Ukraine at the time of the crash. In background information, the 
Royal Dutch Society for Weather and Astronomy noted that meteors fall for the last 
10-15 km in an almost vertical path, meaning that any such impact would be directly trom 
above, perpendicular to an assumed flat ground surface. 


The chance of a meteor striking an aeroplane was calculated as being one event in 59,000 
to 77,000 years. This value was obtained from the University of Pittsburgh’s Department of 
Geology and Planetary Science and was originally part of the NTSB’s investigation into the 
1996 accident to TWA flight 800 (see NTSB Report AAR-00/03, dated 23 August 2000). 
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2.18.3.2 Space debris 

The Aerospace Corporation, a research and development centre based in the United 
States of America that works with space programmes, maintains a register of the re-entry 
of space debris. This register stated that no space debris re-entered the earth's 
atmosphere in the period 10 to 19 July 2014. 


Summary of meteor and space debris information 


e The chance of a meteor striking an aeroplane was calculated as being one event ae 
in 59,000 to 77,000 years. 2 Factual 


information 


e No ‘ultranoise’ was recorded in Ukraine at the time of the crash. 
e No re-entering space debris was known that could have hit the aeroplane. 


2.18.4 Safety actions taken 
Following the crash, at 15.00 (17.00 CET) on 17 July 2014 the UkSATSE issued NOTAM ieee erica 


A1507/14. This NOTAM added another restricted area above the existing area, ae 
commencing at FL320 to an unlimited altitude. 


At 23.00 on 17 July 2014 (01.00 CET, 18 July), UkKSATSE issued NOTAM A1517/14, which 
increased the size of the restricted area and imposed a limitation from the surface to an 
unlimited altitude. This NOTAM became effective at 00.05 (02.05 CET) on the morning of 

18 July. Table 13 summarises these NOTAMs. These two NOTAMS, issued by UkSATSE cae ie nie 
and covering an area of the eastern part of Ukraine, closed the airspace. 


NOTAM number Valid from (UTC) 


1507/14 piesy20 UNL 17 July, 15.00 





Part B: 
1517/14 SFC UNL 18 July, 00.05 7 Flying over 
Ukraine 


Table 13: Ukrainian NOTAMSs post-crash. 


2.19 Useful or effective investigation techniques 
. a Part B: 

ICAO Annex 13 reserves a paragraph for providing information on useful or effective 9 Assessing the 

investigation techniques that may be of use in future air accident investigations. risks 


2.19.1 Wreckage registration and tagging 

During the on-site recovery missions in Ukraine, wreckage parts were tagged, photographed 
and registered. During the transportation to the Netherlands, this process was checked at 
the different locations where parts were transferred to other means of transportation. o 
Recommendations 
Upon arrival at Gilze-Rijen Air Force Base the wreckage was visually inspected, pieces of 
wreckage were given a tag with an identification number and were then photographed 
in front of a green screen. A database was created containing the following details for 


each tagged piece of wreckage: 
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e the identification of the part found; 

e its location in the aeroplane; 

e the location where it was found in Ukraine; 
e all the images made of that part or piece. 


The Dutch Satety Board collected and maintained an archive of photos and videos of the 
wreckage and the wreckage sites that were taken from 17 July 2014 onwards by 
investigators, media and police. The photographic and film material was used in the 
database for wreckage registration. The information was valuable in noting whether 
wreckage had remained undisturbed at the crash site or had been moved or taken away. 
This information also assisted in the planning of the wreckage recovery missions. 


2.19.2 Wreckage identification 

The location of parts of the aeroplane was based on the appearance of the part, any 
special features noted, station and stringer numbers on the parts. The fracture pattern of 
the fuselage skin and its frame was drawn on a two-dimensional grid of stations and 
stringer numbers. From these drawings it was possible to see whether parts were 
adjacent or whether parts were missing. 


The images of the parts were placed on a two-dimensional grid of station and stringer 
numbers to make a digital two-dimensional reconstruction of the aeroplane. The photos 
were also used to mark the mode of deformation of each fracture surface. For the 
fractures analysed, the direction of the fracture and the direction of the principal stress 
were determined when possible. The nature of a fracture was determined based on the 
features of static overloading, fatigue and corrosion. For static overloading, the major 
deformations or fractures observed were linked to the type of overloading, i.e. pure 
tensile, tensile-shear, tensile-bending or tear. Together with the examination of the 
fractures, deformation of all parts was studied, both the in and out of plane deformations. 
These deformations aided in interpreting the major load components leading to each 
fracture. 


The major fractures were determined from the two-dimensional drawings and photo 
reconstruction. The location on the ground where these parts were found was also 
indicated on the digital two-dimensional photo reconstruction. Finally, all information 
was combined to gain an insight of the break-up. 


2.19.3 Wreckage reconstruction 

The reconstruction of the aeroplane’s fuselage and parts of the cockpit assisted the 
investigation and allowed the Dutch Safety Board to demonstrate the results of the 
investigation. The reconstruction was intended to demonstrate the answers to the 
following questions: 
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e From which position relative to the aeroplane did the high-energy objects come? 

e What were the effects of the impact of the high-energy objects on the aeroplane 
structure? 

e How did the aeroplane break up? 


The physical evidence of the recovered wreckage and other investigation activities were 
sufficient for the Dutch Safety Board to complete the investigation. The reconstruction was 
of significant value to the investigation as it allowed the investigators to better visualise the 
recovered wreckage and the damage when comparing the analyses performed with the 
parts of the wreckage. The assembly of the wreckage into a three-dimensional recon- 
struction provides the relatives of the passengers and crew, the stakeholders and the 
public with compelling physical evidence of some of the main conclusions drawn in the 
investigation. 


2.19.4 High-energy object analysis 

Four studies regarding the source of the high-energy objects and the damage they 
caused were produced by specialist external laboratories as part of the investigation. 
The Dutch Safety Board requested specialist assistance trom the Dutch National 
Aerospace Laboratory (NLR) and the Netherlands Organisation for Applied Scientitic 
Research (TNO). 


The NLR work was performed by the Defence Systems Department. This department 
provides operational, technical and scientific support to the Dutch Ministry of Defence in 
general, and the Royal Netherlands Air Force in particular. The main research subject is 
airborne self-protection, which requires an extensive knowledge of the performance of 
surface-to-air and air-to-air weapon systems. For this purpose the department has several 
tools at its disposal. One of these is the Weapon Engagement Simulation Tool (WEST), 
an in-house developed software tool to simulate the flyout and performance of threat 
systems. The work was performed using pieces of wreckage at the Gilze-Rijen Air Force 
Base, photographs and three-dimensional laser scans of some of the parts of the 
aeroplane. The NLR report is contained in Appendix X. 


TNO used a computer-based ballistic simulation to reconstruct the damage from an 
assumed warhead when striking the aeroplane. This TNO report is contained in Appendix Y. 


TNO performed a blast damage simulation using a computer model of the warhead. A 
Computational Fluid Dynamics simulation was performed to provide a high fidelity, 
quantitative, description of the blast loading that would be caused by the detonation of 
the warhead identified by NLR and TNO taken into account the evidence found. This 
TNO report is contained in Appendix Z. 


The details of how the software models for each company performs its calculations are 
proprietary information to those companies and have, as such, not further been 


described. 
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3.1 Introduction 


In this section, the significance of the relevant facts and the circumstances surrounding 
the crash are analysed. In Section 2.12, it was established that the wreckage of flight 
MH17 was spread out over a large area, indicating an in-flight break-up. In addition, the 
break-up occurred after an abrupt loss of electrical power. In this analysis six main 
subjects are distinguished: 


1. General matters, including the flight crew’s qualifications and the airworthiness of the 
aeroplane; 

2. The flight before the in-flight break-up, including pre-flight planning, weather 
considerations and flight operations; 

3. The moment of the in-flight break-up; 

4. The in-flight break-up, its aftermath and causes: 


- a damage analysis of the wreckage, with emphasis on the perforation of the 
aeroplane; 

- the source of the high-energy objects that perforated the aeroplane; 

- failure analysis of the aeroplane structure, and 

- passenger oxygen system. 


5. Survival aspects, and 
6. The recording of radar surveillance data. 


These subjects are chronologically presented with specific attention to the loss of 


electrical power, the break-up and their causes. A number of different scenarios and 
possible causes are considered and analysed. 


3.2 General 
3.2.1 Flight crew qualifications 
Based on the information in Section 2.5, the flight crew members were in possession of 
valid licences and medical certificates. 
Findings 


The flight crew members were in possession of valid licences and medical certificates. 
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3.2.2 Airworthiness 


3.2.2.1 General 

In order to establish the airworthiness of the aeroplane prior to the flight on 17 July 2014, 
the investigation reviewed the way that Malaysia Airlines planned, performed and 
documented the maintenance of the aeroplane. For example, Malaysia Airlines’ documented 
system for the evaluation, deferral and later rectification of technical defects of the 
aeroplane was examined. In addition, a list containing occurrence reports for the subject 
aeroplane from the aeroplane’s delivery in 1997 to November 2013 was reviewed. The 
background to the material in this paragraph is contained in Appendix J. Two specific 
matters were analysed with regard to the crash. These relate to the aeroplane’s pressure 
cabin and to the engines. 


3.2.2.2 Pressure cabin 

None of the mandatory occurrence reports for the aeroplane involved in the crash sent 
to the Department of Civil Aviation Malaysia between aeroplane’s delivery in 1997 and 
November 2013 were related to the functioning of the pressure cabin. 


Aeroplane technical log entries revealed that since the heavy maintenance check in 
November 2013 cabin doors and a cockpit window produced buzzing or hissing sounds. 
These type of complaints, which occasionally occur with jet aeroplanes, were caused by 
leaking seals and were repaired. As such, these sounds may bring some discomfort for 
passengers and crew, but would not cause a depressurisation. According to the aeroplane 
technical log, no such complaints were present on leaving Amsterdam for the return 
flight to Kuala Lumpur. 


The Flight Data Recorder indicated that until the end of recording the cabin pressure 
altitude was constant at 4,800 feet and correct for the cruise level at that time and no 
warnings were recorded. Analysis of the passenger oxygen system is contained in 
Section 3.12. 


The aeroplane’s rear pressure bulkhead and adjacent parts of the fuselage were not 
found at the beginning of the debris pattern (sites 1, 2 and 3) but in site 4 (see paragraph 
2.12.2.4). This indicated that the failure of the rear pressure bulkhead was of a secondary, 
rather than a primary failure. The fractures were predominately consistent with tensile 
overstress indicating an instant overload resulting in a failure of the rear bulkhead 
structure rather than, for example, a failure due to a faulty repair, fatigue or corrosion 
(see paragraph 3.11.5 for more information on the rear pressure bulkhead). 


Maintenance information and occurrence data from Malaysia Airlines was reviewed back 
to the aeroplane’s delivery in 1997. This data did not reveal any tail strike occurrences or 
damage to the bulkhead. In addition, the physical evidence derived from the investigation 
in the Netherlands allows the Dutch Safety Board to conclude that the rear pressure 
bulkhead was not damaged prior to the flight on 17 July 2014. 


In paragraph 2.18.1, the contents of Boeing Service Bulletin 777-53A0068 and 
Airworthiness Directive 2014-05-03 were described. These documents addressed the 
risk of a fuselage skin rupture due to corrosion under those SATCOM antennae installed 
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on top of the fuselage. This could result in depressurisation. The upper fuselage skin 
area mentioned in the Service Bulletin was not recovered. However, Boeing and Malaysia 
Airlines documentation revealed that the SATCOM antennae on the aeroplane that 
crashed were installed above the rear passenger doors. This is a different location than 
the 777 aeroplanes addressed in the Boeing Service Bulletin. Therefore, neither Boeing 
Service Bulletin 777-53A0068 nor Airworthiness Directive 2014-05-03 were applicable to 
the aeroplane that crashed. 


According to Malaysia Airlines documents, a part of the fuselage at section 46 had been 
repaired. This part of the fuselage was recovered and examined. The repair to the 
fuselage skin was still in place and intact. 


The aeroplane’s structural integrity is further analysed in paragraphs 3.11.2 to 3.11.5. 


3.2.2.3 Engines 

Information regarding engine maintenance carried out for the past three years by the 
operator was received. It was not possible to determine whether complaints - if any - were 
relevant to the investigation. However, aeroplane technical log entries since the last 
major maintenance check in November 2013 did not show significant engine anomalies. 
On 17 July 2014, the aeroplane technical log contained no complaints about the engines. 
In addition, none of the occurrence reports referred to in paragraph 3.2.2.1 were related 
to the functioning of the engines. 


The minor damage to the acoustic liners in the engine that was noted in the technical log 
from time to time was considered to be consistent with normal wear and tear of the 
engine. Such damage did not pose any hazard to the engines. 


An analysis of Rolls-Royce’s Engine Health Monitoring data (see Appendix J) concluded 
that no engine operating parameter limits were exceeded during the period between 4 
and 17 July 2014. It can be concluded for both engines that there is no evidence of either 
engine having encountered a failure or having shown unusual engine behaviour prior to 
the departure from Schiphol on 17 July. 


Findings 


The Dutch Satety Board found no evidence to suggest that the aeroplane was not in 
an airworthy condition on departure from Amsterdam Airport Schiphol. There were 
no known technical malfunctions that could affect the safety of the flight. 


3.3 The flight before the in-flight break-up 


3.3.1 Pre-flight planning 

Flight Data Recorder data from this flight and several previous flights, were reviewed in 
order to determine the operator's fuel calculation policy. The data indicated that the 
flights landed with final reserve fuel (30 minutes flight time), diversion fuel and 20 minutes 


i = y 4 106.01 277 









Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 
7 Flying over 
Ukraine 


Part B: 
9 Assessing the 
aL « 


a 
Recommendations 


16 
List of appendices 


contingency fuel. This represented a fuel value of between about 8,000 kg and 10,000 kg. 
For flight MH17 the planned fuel remaining was 8,800 kg. 


Based on Section 2.6, the aeroplane’s mass and balance were within the required 
manufacturer’s limits. There were no dangerous goods loaded as cargo. 


An air traffic control flight plan was filed and the flight crew was provided with an 
operational flight plan, NOTAMs, loading and weather information. 


There were no technical defects noted on the aeroplane technical log that would have 
affected the safety of the flight. 


Based on paragraph 2.9.3, the planning of the flight route through Ukraine included the 
flight across the Dnipropetrovsk Flight Information Region at FL330 - FL350. For this part 
of the route there were no restrictions for these altitudes. 


Findings 


e The pre-flight planning was conducted according to the applicable procedures. 
e The mass and balance of the aeroplane were within authorised limits. 
e There were no airspace restrictions affecting the planned route. 


3.3.2 Flight execution 


3.3.2.1 Vertical profile 

As stated in Section 2.1 of this report, the airline’s operational flight plan called for a 
climb from FL330 to FL350 at a point 74 NM before PEKIT, whilst the air traffic control 
flight plan called for the climb to be made at PEKIT. This apparent discrepancy is the 
result of the fact that the air traffic control flight plan is prepared earlier than the 
operational flight plan and that the latter document takes account of a more recent 
forecast for wind speed and direction. The operational flight plan is therefore more 
accurate than the air traffic control flight plan as it contains recent weather information. 


However, 6 NM before PEKIT, the captain decided to deviate from the planned vertical 
profile by not climbing to FL350 as requested by the air traffic controller but maintained 
FL330. It is not known why the flight crew did not accept this request as the flight crew 
did not provide the air traffic controller with an explanation. The air traffic controller did 
not request an explanation either. 


The Dutch Safety Board tried to tind an explanation for this operational decision by 
discussing the operator’s procedures with Malaysia Airlines. Malaysia Airlines showed 
that, as per the Boeing performance handbook, the optimal altitude to use for the 
prevailing conditions was 33,800 feet at the time of the air traffic controller's request and 
for the following 8 to 10 minutes. The optimal altitude in this case is related to fuel 
efficiency. As FL340 is a non-standard level for an eastbound flight (see paragraph 2.9.3), 
the flight crew, in the opinion of Malaysia Airlines would have preferred to remain at 
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FL330. According to information provided by Malaysia Airlines, and included in the 
operational flight plan, the weather forecast showed that the likelihood of turbulence was 
less at FL330 than at FL350. Whilst neither factor can be contirmed as reflecting the flight 
crew’s decision process, the Dutch Satety Board is of the opinion that the decision not to 
climb trom FL330 to FL350 was a normal operational decision made by the flight crew as 
the result of normal operational considerations. 


Finding 


The flight crew's decision not to accept the air traffic controllers request to climb 
from FL330 to FL350 was determined to be a normal operational consideration. 


3.3.2.2 Horizontal profile 

A comparison of the fuel consumption was made based on the last position report sent 
by Aircraft Communications Addressing and Reporting System (ACARS) and the 
operational flight plan. According to the operational flight plan, the aeroplane should 
have passed air navigation waypoint PEKIT after 2 hours and 26 minutes flight time with 
72,300 kg of fuel remaining. A position report transmitted by ACARS for a point 20 NM 
past PEKIT showed that the aeroplane had flown 2 hours and 25 minutes and had 
73,000 kg of fuel on board. 20 NM equates to about 2 or 3 minutes of flight and 40 kg of 
fuel. The differences between the planned and the actual fuel consumption was 
considered negligible. It was concluded that the flight proceeded as planned up to the 
moment that the flight crew made a request to divert slightly to the north. 


According to Section 2.7, the weather forecast for flight MH17 was similar to the actual 
weather on 17 July 2014, as determined by aftercast. The weather was composed of 
thunderstorms moving north from the Black Sea. Cloud cover varied between partial and 
overcast over the eastern part of Ukraine. The weather was consistent with thunderstorms 
that a flight crew would reasonably be expected to circumnavigate. 


According to the information in paragraph 2.9.6, shortly after 13.00 (15.00 CET), the flight 
crew requested a slight deviation around bad weather and received permission from 
Dnipro Radar to deviate from the planned flight route. The aeroplane turned left to the 
north-east. When approximately 6.5 NM north of the centreline of the airway L980 and 
abeam air navigation waypoint TAGAN, the flight continued parallel to the L980 airway in 
order to avoid the bad weather. In view of the forecast and actual weather, the flight 
crew's request and flight execution to deviate slightly to the north of the planned track to 
avoid bad weather were considered consistent with normal operations. The higher and 
more energetic clouds were south of the route, moving north-east. After circumnavigating 
the bad weather, the flight turned slightly back to the right to approach the original route. 
At 13.19:56 (15.19:56 CET) the flight crew acknowledged to Dnipro Radar the clearance to 
proceed direct to waypoint RND. 


At 13.20:00 (15.20:00 CET) Dnipro Radar advised flight MH17 to expect a further 
clearance to proceed direct to TIKNA after RND. The information was not read back or 
acknowledged by the flight crew. At this point in time, the aeroplane was within 5 NM of 
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the centreline of airway L980 and proceeding on a direct track to waypoint RND. The fact 
that the flight crew requested a deviation of 20 NM but only flew approximately 6.5 NM 
north, was consistent with normal operational practice of minimising any additional 
distance flown. 


Part A: 
2 Factual 
information 


The actions of the air traffic controllers are consistent with normal operations. The 
communication between the flight crew and the air traffic controllers by both parties 
appeared normal and was considered consistent with normal operations. 


Findings 


With the exception of a deviation requested by the flight crew to avoid bad weather, 
the aeroplane followed the planned route, airway L980 across Ukraine. The maximum 
deviation from the airway’s centreline was approximately 6.5 NM. This is considered 


normal. 
Part B: 


Introduction to 
Part B 


3.3.2.3 Flight data 

The Flight Data Recorder records approximately 1,300 parameters; for an effective 
investigation a shortlist of parameters considered to be useful for the investigation was 
created in order to gain an insight into the possible cause or causes of the crash. Relevant 
details of the last three minutes of flight recorded on the Flight Data Recorder are 


published in Appendix H. 5 a ee 


The investigation included a verification that the aeroplane’s warning systems had 
functioned correctly and these signals were present on the Flight Data Recorder 
recording. For example, the Flight Data Recorder contained a recording of the activation 
of the aeroplane’s master warning; a warning that should, and was, generated when the 


autopilot was disconnected at a point on an earlier flight. lass 
7 Flying over 


Ukraine 
No aeroplane system warnings or cautions for flight MH17 were recorded on the Flight 


Data Recorder. All engine parameters were normal for cruise flight until the recorders 
ended at 13.20:03 (15.20:03 CET). 


Flight Data Recorder engine parameters were continuously sampled during the flight. ee 
According to the data on the Flight Data Recorder, both engines were running at cruise eR te 
power during the flight across Ukraine. All indications regarding the operation of the risks 
engines were normal and no abnormalities were shown. All of the engine indications 
were as they would be expected to be during cruise flight. No abnormal vibrations were 
recorded. There were no warnings recorded. Appendix H contains an overview of the 
engine data recorded on the Flight Data Recorder. 


ai 
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Findings 


e The Flight Data Recorder contained data for flight MH17. No warnings were 
detected for either aeroplane systems or for the engines in the analysis of the 
Flight Data Recorder data for the flight on 17 July 2014. 

e According to the data, up to 13.20:03 (15.20:03 CET), flight operations were 
normal. 


3.3.2.4 Flight crew 

Analysis of the Flight Data Recorder and the Cockpit Voice Recorder did not reveal any 
indications in the flight crew’s performance that suggested diminished capabilities or 
incorrect actions. 


Based on the results of the toxicological examination conducted, any contribution of 

ethanol (alcohol), drugs, medicines and/or pesticides to the behaviour and/or the flying earners 
skills of the First Officer cannot be concluded and his death cannot be explained on the laa 
basis of the results from the toxicological examination. 


It was concluded that the flight crew handled the aeroplane appropriately. 


eli Part B: 
Findings Ma Mit-wTi Certo 


e The flight crew handled the aeroplane appropriately. 
e There is no evidence that the crew handled the aeroplane inappropriately or the 
First Officer's flying skills were affected by alcohol, drugs or medicine. 


Part B: 


7 Flying over 
Ukraine 


3.4 The moment of the in-flight break-up 


This Section is intended to establish and verify the moment at which the in-flight break-up 
occurred. 

Part B: 
3.4.1 Aeroplane data recorders 9 Assessing the 
According to the information in Section 2.11, the following Flight Data Recorder oe 
parameters as recorded at 13.20:03 (15.20:03 CET) were as shown in the box below: 


a 
Recommendations 
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Aeroplane position 








Latitude 48.12715 N 
Longitude 38.52630538 E 
Altitude'® 32,998 feet 
Indicated airspeed 293 knots 
Magnetic heading 115 degrees 
Drift angle -4 degrees 
rae 

Wind direction 219 degrees 
Wind speed 36 knots 
Static air temperature -44°C 

Total air temperature -12/-13 °C 


Small variations in the data are possible due to differences in resolution from the various 
data sources. 


The latitude and longitude data is shown above in the format that it was recorded in. This 
position is converted to read 48° 07’ 37.74'N 038° 31’ 34.698’E. 


A detailed analysis of the Cockpit Voice Recorder, covering the last 20 milliseconds of 
the recording at 13.20:03 (15.20:03 CET) as described in paragraph 2.11.2, was performed. 
The analysis showed that two peaks of sound were identified in this timeframe. Using 
specialised audio recording analysis software, a graphical representation of the sound 
over time, its waveform, could be established. The waveform analysis assisted in 
determining the signal's characteristics, for example, duration and energy. 


The first sound peak had a duration of 2.1 milliseconds and the signal was recorded on 
the cockpit area microphone channel only. Because no other Cockpit Voice Recorder 
channels recorded the first sound peak, the direction of this signal could not be 
established. Wave spectrum analysis suggested that the sound peak was representative 
for an ‘electrical spike’ as it showed the form of an electro-magnetic pulse that could 
have been caused by static discharge or similar. 


Signal triangulation was used to determine the origin of the second sound peak recorded 
on the Cockpit Voice Recorder. The poor sound quality on the cockpit area microphone 
channel noted during the investigation was most likely due to the missing microphone 
cap from the cockpit area microphone. The fact that the microphone cap was missing 
was noted on the aeroplane’s deferred defects list. 





18 Altimeter set to the standard pressure of 1013.25 hPa. 
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The time difference between the first and the second sound peak was determined to be 
2.3 milliseconds. The second peak had a duration of 2.3 milliseconds and was recorded 
by all four channels. However, the recordings of the second peak were not simultaneous 
on all channels; some of the recordings had a different timestamp. The wave spectrum is 
representative for a sound wave. The time difference between the channels showed that 
the sound was recorded by the cockpit area microphone (CAM) and pilot 1 (P1) 
microphones first, followed by the pilot 2 (P2) microphone and, lastly, the observer (OBS) 
microphone. This difference in time showed that the sound wave originated outside the 
aeroplane starting from a position above the left hand side of the cockpit, propagating 
from front to aft (see Figure 43). It is concluded that the event was highly energetic in 
nature based on the short time duration of the event. 


Peak 2 


Cockpit, from above Cockpit, Cross-section (looking back) 





Not to scale 


Figure 43: Second sound peak - graphic representation. (Source: Dutch Safety Board) 


The fact that the microphone cap of the cockpit area microphone was missing did not 
influence the calculation. However, during the investigation, the Dutch Safety Board 
noted that the sound peaks were of such short time duration that any minor differences 
in recording will cause the signal triangulation to be erroneous. For example, signal 
latency (refers to a short period of delay between when an audio signal enters and when 
it emerges from a system) can be influenced by the Cockpit Voice Recorder microphone 
wiring. When one microphone wire is ‘longer’ compared to others this may affect the 
time for the signal to reach the Cockpit Voice Recorder. Nonetheless, the signal 
triangulation is consistent with the impact damage on the left side of the cockpit. 
Therefore it is likely that the origin of the sound peak recorded on the Cockpit Voice 
Recorder is a high frequency sound wave from outside the cockpit. 


The Flight Data Recorder data as described in paragraph 2.11.3 and Appendix H was 
examined to try and identify any acceleration or deceleration associated with the sound 
wave that had been recorded on the Cockpit Voice Recorder. The following three axes of 
acceleration with their sampling rate were recorded on the Flight Data Recorder: 


e longitudinal acceleration: 4 times a second (4 Hz); 
e vertical acceleration: 8 times a second (8 Hz): 
e lateral acceleration: 4 times a second (4 Hz). 
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The acceleration data on these three axes was examined and all three axes showed 
stable data up to the recording’s end at 13.20:03 (15.20:03 CET). 


Findings 


e The Cockpit Voice Recorder audio ended abruptly. The short noise peak recorded 
in the last 20 milliseconds of the recording was a highly energetic sound wave. 
Signal triangulation showed that the noise originated from outside the aeroplane, 
starting from a position above the left hand side of the cockpit, propagating from 
front to aft. 

e The sound wave detected in the last 20 milliseconds of the Cockpit Voice 
Recorder recording could not be observed in the form of acceleration data on 
the Flight Data Recorder. 


3.4.2 Surveillance radar data 

The radar data that was received from Ukraine trom UkSATSE showing flight MH17, is 
described in paragraph 2.9.5.2. From the Ukrainian raw radar data it was established that 
the last secondary surveillance radar return was at 13.20:03 (15.20:03 CET) with the 
aeroplane flying straight and level at FL330. The video radar replay did not show any 
radar targets in the vicinity of flight MH17 at that time other than the three commercial 
aeroplanes mentioned in paragraph 2.9.5.2 


The surveillance radar data showing flight MH17, that was received from the Russian 
Federation were from GKOVD, is also described in paragraph 2.9.5.2. Flight MH17’s 
target was detected by primary surveillance and secondary surveillance radar. A second 
primary target was generated close to the target labelled MH17 on two occasions. No 
other data was received. Due to the absence of raw data, it was not possible to verity the 
video radar replay. The video of the radar screen did not show any failures, emergency 
codes or other alerts of flight MH17. 


The Ukrainian radar data, comprising of both raw and processed data as described in 
paragraph 2.9.5.1 was analysed separately. The last radar data recorded by UkSATSE 
showing no abnormalities with the target or symbol for flight MH17, was at 13.20:00 
(15.20:00 CET). Time 13.20:03 (15.20:03 CET) coincided with two data points in the raw 
data from secondary radar information provided by UkSATSE. The last position message 
from the aeroplane’s Automatic Dependent Surveillance - Broadcast data and the last 
secondary radar target identitication message both have a time stamp of 13.20:03 (15.20:03 
CET). The processed data showed that no secondary surveillance data was displayed from 
13.20:18 (15.20:18 CET) and that the coasting mode was activated at 13.20:36 (15.20:36 
CET). Due to processing delays, it is not expected that the radar display will coincide with 
the actual time of the last secondary surveillance data transmission; this may occur later. 


The target data for flight MH17 was lost on the GKOVD radar screen at 13.20:58 
(15.20:58 CET). At that moment the secondary radar label changed to ‘xxxx’. The 
22 seconds between the label changes and the change to coasting mode on the UkSATSE 
radar can be explained by the different software settings in the two radar systems. 
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On the GKOVD video (see Appendix |), a second radar target, close to the MH17 labelled 
target, was visible for 21 seconds between 13.20:47 - 13.21:08 and for 40 seconds 
between 13.21:18 - 13.25:57 (15.20:47 - 15.21:08 and 15.21:18 - 15.25:57 CET). The second 
target was considered to be aeroplane debris falling down and having sufficient reflection 
to be detected as a primary target. This is consistent with the wind direction and final 
position of the wreckage. 


From the information provided by UkSATSE and GKOVD, there were no radar targets 
other than the three commercial aeroplanes identified in paragraph 2.9.5.2, either 
commercial or military, displayed on the air traffic control screens within a range of 30 to 
60 km to the south of flight MH17 and more than 90 km to the north and east and about 
200 km to the west. There are no other unidentified primary or secondary targets visible 
within 30 km of flight MH17 in these data. 


There are a number of factors that affect the ability of a civil primary radar system to 
detect and display a small, fast-moving missile on a radar screen. The two most significant 
are detection sensitivity and system filtering. Detection sensitivity refers to the power of 
the radar system dictates how small an object can be detected and at what range it can 
be detected. System filtering is intended to remove phenomena from a radar screen that 
are detected but are not required to be displayed, e.g. rain. The high speed of the missile 
may result in the radar system filtering the detected signal out of the images displayed 
on the screen as it would, correctly, not appear to be the signal of an aeroplane. 


It is concluded that it is very unlikely that the air traffic control primary radar systems in 
the area could detect and display the missile on the air traffic controller's screen. 


Findings 


e The raw UkSATSE surveillance radar data and the GKOVD radar screen video 
replay showed that flight MH17 was on a straight and level flight at FL330 until 
13.20:03 (15.20:03 CET). 

e Coasting tracks were observed on both sets of radar data. Coasting tracks were 
shown on the GKOVD radar screen video replay of primary and secondary radar 
trom 13.20:03 (15.20:03 CET) and onward. 

e The GKOVD radar screen video replay from 13.20:47 - 13.21:08 and 13.21:18 - 
13.25:57 (15.20:47 - 15.21:08 and 15.21:18 - 15.25:57 CET) showed targets which 
are considered to be aeroplane debris falling down. 

e The radar information provided showed that the only aircraft in the direct vicinity 
of flight MH17 were three commercial aeroplanes. There was no evidence of 
other traffic in the vicinity of flight MH17. 


3.4.3 Determining the events around 13.20 (15.20 CET) 
This paragraph examines other, verifiable, recorded data so as to analyse the hypothesis 
that electrical power was lost at the moment that the recorders stopped recording. 
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In Section 2.11 it was established that the Cockpit Voice Recorder and Flight Data 
Recorder both stopped recording at 13.20:03 (15.20:03 CET). In paragraphs 2.9.5.2 and 
3.4.2, it was shown that the transmission of radar surveillance data from flight MH17 
ended at 13.20:03 (15.20:03 CET). 


Following a final SATCOM transmission at 13.08:51 (15.08:51 CET), the ground system's 
inactivity timer ran out approximately 15 minutes later, as it is programmed to do. An 
attempt by the SATCOM system at 13.21:26 (15.21:26 CET) to establish connection with 
the aeroplane from the ground was not successful. 


A signal from the fixed Emergency Locator Transmitter was first received at 13.20:35 
(15.20:35 CET) by Geostationary satellites of the emergency COSPAS-SARSAT network. 
According to the ELT’s specifications (see paragraph 2.11.5), an automatic, acceleration 
or deceleration triggered, activation of the fixed Emergency Locator Transmitter has a 30 
seconds delay. A manual activation, by a guarded switch located in the overhead panel 
in the cockpit, of the fixed ELT has a delay of 50 seconds whereafter the ELT is activated 
and detectable by Geostationary satellites. A second delay for both a manual or 
automatic activation of approximately 1 or 2 seconds is expected due to signal latency 
while going through the emergency satellite network. 


Five ground stations received an Emergency Locator Transmitter signal which had been 
relayed by two satellites between 13.20:35 and 13.20:36 (15.20:35 and 15.20:36 CET). 
Considering the time of the receipt of the signal and the 50 second time delay on manual 
activation, it was concluded that manual activation would have had to have occurred 
around 13.19:45 (15.19:45 CET). This would have been recorded on the Flight Data 
Recorder and, in all probability, on the Cockpit Voice Recorder. As this is not the case, 
manual activation of the ELT is discounted. 


The receipt of the signal, considering an automatic activation of the fixed ELT, with a time 
delay of 30 seconds plus 1 or 2 seconds, would suggest an activation time between 
about 13.20:05 - 13.20:06 (15.20:05 - 15.20:06 CET). The automatic activation was caused 
by the Emergency Locator Transmitter’s G-switch detecting a longitudinal deceleration 
of between at least 2.0 g and 2.6 g. This is consistent with the aeroplane breaking up 
after the recorders stopped at 13.20:03 (15.20:03 CET). 


A second ELT, a portable Emergency Locator Transmitter, was onboard that can only be 
activated manually. No signal from the portable ELT was detected by the COSPAS- 
SARSAT emergency network. 


The loss of the two recorders and the radar data at 13.20:03 (15.20:03 CET) indicated 
that the electrical power was lost at this moment. The automatic activation of the fixed 
ELT between 13.20:05 - 13.20:06 (15.20:05 - 15.20:06 CET), caused by a deceleration, 
supported this. Finally, no other recorded data (e.g. SATCOM transmissions) contradicted 
the hypothesis. 


All times mentioned (in UTC only) that support this conclusion are set out in chronological 
order in Figure 44. 
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13.19:55 
13.20:00 13.20:00 Last UkSATSE radar acquisition 


13.20:03 CVR recording ends /FDR recording ends/UkSATSE last message reception 


L200 (raw data)/UkSATSE last target detection (raw data) 


13.20:10 
13.20:15 13.20:18 UkSATSE mode S data no longer displayed 
13.20:20 


13:20:25 


13.20:30 
13.20:35 Fixed ELT activation detected 


13.20:36 UkSATSE display enters coasting mode 


13:20:35 


13.20:40 


UA 13.20:47 GKOVD first appeared of primary targets around MH17 symbol 
3:20:50 


13.20:55 13.20:58 GKOVD MH17 ‘label change to xxxx’ target lost 
spa O10) 
1 CPA Oo) 
eA 0) 
SEA lke) 
13.2120 
ae 13.21:26 
13:21:30 


3325/55 
13.26:00 


SATCOM no aeroplane response 


13.25:58 GKOVD primary target no longer displayed 





Figure 44: Diagram showing a number of key moments in the recorded data. (Source: Dutch Safety Board) 


Findings 


e The Cockpit Voice Recorder and Flight Data Recorder stopped recording at 
13.20:03 (15.20:03 CET) due to electrical power interruption. 

e The fixed Emergency Locator Transmitter was automatically activated by a 
longitudinal deceleration of between at least 2.0 g and 2.6 g. Its signal was first 
detected between 13.20:35 and 13.20:36 (15.20:35 - 15.20:36 CET). System logic 
means that the ELT was activated between about 13.20:05 and 13.20:06 
(1520-05-15 20/06. =i) 


3.5 Possible sources of damage 


In paragraphs 3.4.1 and 3.4.3 it was shown that shortly before the Cockpit Voice Recorder 
stopped recording at 13.20:03 (15.20:03 CET), a high-frequency sound wave was 
detected, originating outside the aeroplane from a position above the left hand side of 
the cockpit propagating from front to aft. Shortly after the Cockpit Voice Recorder and 
Flight Data Recorder stopped recording the Ukrainian and Russian Federation radar data, 
SATCOM data and ELT activation data all show that the aeroplane suffered structural 
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failure and lost electrical power, experienced a deceleration (described in paragraph 
3.4.3), and started to break up. The complete in-flight break-up sequence is analysed in 
Section 3.10. 


In this section the possible scenarios that could have led to the in-flight break-up of the 
aeroplane’s structure are described and analysed. Some of the scenarios were related to 
internal aspects such as airworthiness, whilst others were related to external sources. 
Those scenarios that were found not to be able to cause the damage noted (see Section 
2.12) were, following analysis, excluded. 


3.5.1 Lightning strike, meteor and space debris re-entry 

Although there were thunderstorms in the area at the time of crash (see Section 2.7), 
there was no evidence in the wreckage recovered or on the recorded data that a lightning 
strike occurred that could have caused or exacerbated the high-energy object damage. 


Based on the evidence provided by the Royal Netherlands Association for Meteorology 
and Astronomy regarding the lack of ‘ultranoise’ in Ukraine on the date of the crash as 
described in paragraph 2.18.3.1, and the damage patterns on the aeroplane, it was 
concluded that a meteor strike did not occur. 


In addition, the possibility that soace debris caused the crash was considered (see 
paragraph 2.18.3.2). The Aerospace Corporation database for 2014 showed no debris 
re-entering the atmosphere between 10 and 19 July 2014. 


Finding 


The in-flight break-up was not caused by an external event such as a lightning strike, 
the impact of a meteor or the re-entry of space debris. 


3.5.2 Possible internal causes 

The sound wave lasting 2.3 milliseconds that was recorded in the last 20 milliseconds on 
the Cockpit Voice Recorder did not contain the same signature wave form as either an 
internal explosion (bomb or fuel tank) or structural failure and explosive decompression. 
Examples include the accident to flight PA103 at Lockerbie (Scotland) in 1988 and flight 
TWA 800 off Long Island (United States of America) in 1996. In these two cases, the 
sound signature was about 200 milliseconds long with the internal explosion building 
very quickly to high value with a very short wavelength. The sound wave then dissipated 
over time. In the case of structural failure and explosive decompression, the time is 
similar but the peak noise was lower and the rate of dissipation was slower. 
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Findings 


The form of the 2.3 millisecond sound wave did not match the signature waveforms 
associated with structural failure and explosive decompression in a number of 
previous aeroplane accidents. 


Fuel tank explosion 
A tuel tank explosion was not able to produce the sort of high-energy object perforation 
from outside the fuselage. 


Had a fuel explosion taken place, evidence of ruptured fuel tanks, with deformation of 
the tanks pushing from the inside outwards should be found. The fuel tanks were not 
recovered as they were destroyed in the fire at wreckage site number 6. However, the 
fact that a large fire took hold on the ground is an indication that the fuel tanks were 
reasonably intact and had a large quantity of fuel to feed the fire that took hold. 


Finding 


The in-flight break-up was not caused by a fuel tank explosion. 


Uncontained engine failure 

Another source of damage to the aeroplane was considered; an uncontained engine 
failure. In such an event, high-speed rotating parts of the engine are freed from within 
the engine intake ring. Such parts have sufficient energy to penetrate the fuselage. In 
this case, the shape of the perforation holes did not resemble the shape that would be 
caused by engine parts. In addition, an uncontained engine failure would not damage 
the cockpit. The fuselage damage would be restricted to areas adjacent to the engine. 


The analysis of the Flight Data Recorder data found neither evidence of a condition that 
could lead to an uncontained failure or any other malfunction to the engines up to 
13.20:03 (15.20:03 CET). On the basis of the above, an uncontained engine failure was 
excluded as a possible cause of the damage to the aeroplane. 


Finding 


The in-flight break-up was not caused by an uncontained engine failure. 


Detonation of an explosive device in the cabin/baggage hold 

Whilst the break-up sequence of the fuselage described in Section 3.11 of this report had 
some similarities with the failure and break-up sequences noted in accidents such as 
those at Lockerbie in 1988, this crash differed with the Lockerbie accident and other 
similar accidents in that the perforation was from the outside. An explosive device inside 
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the pressure hull of the aeroplane would not be able to produce the damage patterns 
found in the wreckage; therefore an explosive device detonating inside the aeroplane 
was excluded as a possible cause of the crash. 


Finding 


The in-flight break-up was not caused by the detonation of an explosive device 
inside the aeroplane. 


Fire due to dangerous goods or other baggage 

With the exception of a single Lithium-ion battery, the review of the cargo manifest 
described in paragraph 2.6.2 showed no evidence that any materials were being carried 
that could have started a fire. There was no fire warning recorded on the Flight Data 
Recorder and the crew made no mention of any such event, as recorded on the Cockpit 
Voice Recorder. 


As with the other scenarios, a fire inside the aeroplane would not be able to produce the 
damage patterns found on the wreckage. Therefore, an on-board fire was excluded as a 
possible cause of the crash. 


Findings 


e There was no cargo classified as dangerous goods on board the aeroplane, nor 
was any evidence found of a fire caused by dangerous goods inside the 
aeroplane. 

e The in-flight break-up was not caused by an on-board fire. 


3.5.3 Damage from external causes 

As none of the potential causes of damage analysed were able to produce the damage 
observed to the aeroplane and, in particular, the cockpit area, external causes were 
further analysed. 


In Section 2.12, hundreds of holes and ricochet marks that were observed on the forward 
fuselage and in the cockpit are described. The interior of the cockpit, including the left 
hand sides of the cockpit seats, showed evidence of large scale disintegration, extensive 
crushing and had dozens of perforation holes. Section 2.12 also described the holes and 
ricochet marks found on the left engine intake ring and the left wing tip. 


The damage to the forward fuselage was concentrated in a band around the left hand 
side of the fuselage starting adjacent to the cockpit windows 2 and 3. The concentration 
is reduced rearwards of this area and ends ahead of the left hand forward passenger 
door, door 1L. Some witness marks are also noted on the top of the cockpit just above 
the windows. 
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The pattern of damage observed in the forward fuselage and cockpit area of the 
aeroplane was consistent with the damage that would be expected from a large number 
of high-energy objects that perforated the aeroplane from outside. The impact damage, 
described in paragraph 2.12.2, was caused by foreign objects. The examinations of these 
objects (see Section 2.16) classified these objects as high-energy objects that originated 
from outside the aeroplane. 


The damage observed showed evidence of both piercing and plugging perforation 
damage with entry damage bending plate material inwards. The non-penetrating 
damage as well as the ricochet damage clearly originated trom outside the aeroplane. 
On a number of places on the structure, where multiple layers of plate material are 
riveted together, some high-energy objects impacted the structure at a shallow angle, 
perforated the first outer plate but ricocheted back off the second plate, and exited 
through the outer plate. 


The main location of the damage of high-energy objects was on the left hand and upper 
side of the cockpit. The right hand side of the cockpit showed no high-energy object 
damage. As is shown in Figure 45 the two cockpit windows on the right hand side and 
the surrounding structure were unaffected by high-energy object impact. 





Figure 45: Right hand side of cockpit. (Source: Dutch Safety Board) 


There was a relatively clear boundary between parts of the wreckage that were affected 
by the high-energy object impacts and parts that were unaffected. On the front side of 
the cockpit, the boundary was the forward corner of the left hand front window. The 
most forward impact damage occurred just above and aft of this corner. On the top and 
right hand side of the cockpit the damage boundary was indicated by the ricochet 
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impacts on the cockpit roof as indicated in Figure 46. To the right of this area no impact 
damage was present. On the left hand side, the rear impact damage boundary was found 
in front of the left hand forward passenger door. 





Figure 46: Right hand side cockpit roof, looking front to back. (Source: Dutch Safety Board) 


The total number of hits (over 350), of all types of impact damage, on the available 
wreckage of the cockpit suggests that the total number of hits of high-energy objects 
was well over 800. The highest density of hits on the left hand side of the cockpit was 
calculated to be over 250 hits per square metre. The highest density of hits was on the 
left front windows. 


Figure 47 shows the high-energy object damage observed on a number of parts of 
wreckage. In addition, such damage was also noted in a panel of the cockpit roof. The 
high-energy object damage was primarily limited to the left hand side of the cockpit and 
a small part of the fuselage immediately aft of that. At the rearward edge of the panel, 
positioned on the left hand side of the aeroplane between approximately STA220 and 
STA410 close to the forward passenger door and on panels further away from the cockpit, 
no high-energy object damage was noted. The cockpit panel at STA132.5 appeared to 
be the leading edge of the high-energy object damage. 
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Figure 47: Part of the left hand cockpit window frame with enlarged detail. The perforation damage had a 


regular pattern of larger and smaller holes. (Source: Dutch Safety Board) 
The skin plates were further damaged by pitting, which may have been caused by the 


impact of many small hot particles such as high explosive residue and molten metal. The 
pitting damage occurred locally; adjacent panels did not show any pitting damage. 
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Figure 48: Cockpit bulkhead at junction with radome. (Source: Dutch Safety Board) 


Part B: 
There was no perforation damage found in the cockpit bulkhead (Figure 48) that can be 4 Decision making 
identitied, with any certainty, as being trom the perforation of high-energy objects. The 
perforation in the bulkhead was the result of other parts of the cockpit’s structure having 
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For the non-perforating ricochet and grazing hits, the angle relative to the structure was 


measured to give a direction in the flat plane of the structure plate. This was done for the , ae ae 
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cockpit roof (see Figure 49), the lower left hand cockpit side and aft of the cockpit windows. 
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The orientation of the ricochet and grazing marks on the cockpit roof are not parallel but 
they appear to converge towards a point left of the cockpit. Other ricochet and grazing 
marks were noted on the left wing tip. 


To determine the trajectory of the high-energy objects, the direction of the impact 
damage was analysed on several parts of the cockpit area. Using fibreglass rods and 
three-dimensional scans of the structure the direction of high-energy objects penetrating 
multiple layers of material was determined. A network of lines of string passed through 
straight lines of damage was set up. This is known as ‘stringing’ and is used to analyse the 
general direction of impact damage as shown in Figure 50. The results show trajectories 
of perforating damage converging to a general area to the left of, and above, the cockpit. 
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Figure 50: Impression of stringing of the cockpit. (Source: Dutch Safety Board) 





Using the shape and orientation of the witness marks, including the perforation holes in 
the engine intake ring and left wing tip, a trajectory direction was derived. There, most of 
the individual perforation holes were significantly larger than those found in the wreckage 
of the cockpit. 


It should be noted that although the ‘stringing’ is brought to a single point in Figure 50, 
it is not suggested that the point of detonation was actually a small single point. The 
lines are brought together to illustrate the divergent nature of the spray pattern of the 
high-energy objects. Stringing is only used to generate an indication of the detonation’s 
position and is not intended to identify a specific point in space. 


In addition to the damage caused by the perforation or ricocheting of high-energy 
objects, evidence was found for the effects of detonation blast. For example, the cockpit 
floor plate to the left of the left hand seat showed blast deposits, direct pressure damage, 
extensive fragmentation damage and extensive fragment holing. 
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Another example of blast damage was found in a panel on the right hand side of the 
fuselage between STA250 and STA330 (see Figure 51); the fuselage skin was pushea-in 
in the areas relative to the fuselage’s structural support elements (i.e. the stringers and 
frame). These structural support elements showed no deformation. The sort of damage 
noted is typical of a phenomenon known as ‘dishing’. Dishing is a type of damage 
associated with the effects of blast. 
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Figure 51: Blast damage on the forward right hand side of the fuselage. The panel was also damaged by the 
break-up of the aeroplane and impact with the ground. (Source: Dutch Safety Board) 
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Findings 


e The damage observed on the forward fuselage and cockpit area of the aeroplane 
indicated that there were multiple impacts from over 800 high-energy objects 
from outside the aeroplane. 

e The back-traced trajectories of perforating damage converged to a general area 
to the left of, and above, the cockpit. 

e The wreckage of the aeroplane contained over 350 hits from high-energy objects 
that struck the outside of the aeroplane. These witness marks were concentrated 
in a band around the left hand side of the fuselage starting adjacent to the cockpit 
windows 2 and 3. The concentration reduced rearwards of this area and it ended 
ahead of the front left passenger door, door 1L. The highest density was 
approximately 250 witness marks per square metre. 

e Evidence of blast damage was found around the cockpit in the form of pitting 
and soot. Some forward fuselage panels showed deformation as a result of the 
blast. 


3.6 Weapon systems 


In the paragraphs above, a number of external sources of damage were analysed and 
excluded. Because of the nature of the damage, weapon systems that potentially could 
have caused damage to the aeroplane were analysed. The damage produced by each 
weapon system was then compared to the damage found on the aeroplane and to the 
injuries sustained by the aeroplane’s occupants. The weapon systems considered were: 


® alr-to-air gun/cannon; 
® air-to-air missile; 
e surface-to-air missile. 


Although many sorts of weapons exist, the investigation focused on those weapons that 
were considered potentially relevant and are common in the region. 


3.6.1 Air-to-air gun/cannon 

The number of bullets (typically either armour-piercing or high-explosive) that would 
have impacted the aeroplane in the case of air-to-air gunfire under the prevailing 
conditions (i.e. a left frontal hemisphere attack at about 30,000 feet and at the cruise 
speed of flight MH17) is expected not to exceed several dozen at best. This is a much 
lower number than the 350 high-energy object hits that were found on the wreckage of 
the cockpit. 


Air-to-air gun/cannon fire does not produce fragments in the shape of cubes or bow-ties 
as were found in the wreckage and in the bodies of three of the crew members. 


In addition, for an air-to-air gun/cannon to have caused the damage found, another 
aircraft would have to have been recorded by, at least primary radar data. The analysis in 
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paragraph 3.4.2 of this report shows that no (military) aeroplanes were within at least 30 
km of flight MH17 at the time of the crash. Primary radar data was available for an area 
between about 30 to 60 km to the south of the aeroplane’s final position and about 90 
km to the north and east and about 200 km to the west. 


Findings 


The high-energy object damage was not caused by an air-to-air gun or cannon 
because: 


e the number of the perforations was not consistent with gunfire, and 
° air-to-air gun/cannon fire does not produce fragments with the distinctive forms 
that were found in the wreckage and in the bodies of three of the crew members. 


3.6.2 Air-to-air missile 
Two types of air-to-air missile were considered in the investigation; those with a warhead 
filled with rods and those with a fragmentation warhead. 


Air-to-air missiles with a warhead filled with rods eject a ring of metal rods after the 
warhead’s explosive charge detonates near its target. The rods then cut into the target. 
Figure 52 shows an example of the typical damage pattern; where the rods separated 
into individual high-energy objects. 
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Figure 52: Example of damage caused by metal rod warheads. (Source: PPRuNe, via NLR) 


Other air-to-air missiles have fragmentation warheads; warheads that are designed to 
fragment into small, high-energy objects on detonation. 
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Table 14 provides an overview of typical air-to-air missiles in use in the region. The table 
is simplified and excludes variants and derivative versions of the weapons. 


Air-to-air Warhead type Warhead contains bow-tie Warhead mass (kg) 
missile type shaped fragments 
Rod No 39 





R-27 

R-33 Fragmentation No 4/7 
R-37 Fragmentation No 60 
R-40 Fragmentation No 38 
R-60 Rod No B35 
R-73 Rod No 8 

R-77 Rod No 275 








Table 14: Typical air-to-air missiles present in the region. 


No evidence of the characteristic damage produced by a rod warhead was identified 
and no rods were found within the wreckage. Of the three missiles listed in Table 14 with 
fragmentation warheads, none contain the bow-tie shaped fragments described in 
Section 2.16. As none of those air-to-air missiles in use in the region having fragmentation 
warheads that include bow-tie shaped fragments, these missiles cannot have caused the 
damage to flight MH17. 


In addition, for an air-to-air missile to have caused the damage found, another aircraft 
would have to have been recorded by, at least primary radar data. 


Findings 


e The damage pattern found in the aeroplane’s wreckage does not match the 
damage expected from any of the air-to-air missiles in use in the region. 

e None of the air-to-air missiles in use in the region have the distinctly formed 
bow-tie shaped fragments in their warhead. 


3.6.3 Surface-to-air missile 

In the previous paragraphs, possible scenarios from both internal and external sources 
have been excluded on the basis that these sources do not match the damage described 
in Section 2.12 and the high-energy objects that were found in the bodies of the crew 
members in the cockpit and in the wreckage as described in Section 2.13. A final source 
is considered in this paragraph; the surface-to-air missile. 


In the investigation, two types of surface-to-air missile were considered. Portable, 
shoulder-launched missiles known as man-portable air-defence system (MANPADS) and 
larger systems which may be mobile or fixed installations. The basic difference in the 
systems is in size and range. 
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MANPADS could not have caused damage to the aeroplane, because the altitude of 
flight MH17 (33,000 feet) cannot be reached by MANPADS. 


Considering larger systems, these are usually radar guided weapons with guidance being 
provided by a combination of ground control and autonomous ‘seeker’ control. All warheads 
detonate on impact with a target but some also detonate at close proximity on passing the 
target. A proximity fuse uses a beam of radar or laser energy in a cone with a forward angle 
with respect to the missile axis to sense the presence of a target. When a part of the target 
passes through the beam, the target is detected and shortly thereafter the fuse will detonate 
the missile’s warhead. The warhead is typically a fragmentation device. Fragmentation 
warheads are composed of between hundreds and several thousand pre-formed fragments, 
possibly of different shapes, in layer or layers around an explosive core. On detonation, the 
warhead showers the target with these small metal fragments; objects that are designed to 
penetrate the target aircraft structure and weaken it so that it is severely damaged or 
destroyed. Although designed to destroy high-flying military aeroplanes, some of these 
systems have the capability, in terms of both range and speed, to engage an aeroplane 
such as a Boeing 777 operating at the altitude and speed of flight MH17. 


The generic form of a surface-to-air missile is shown in Figure 53. 


Radome/ Wings 
Nose section Seeker/ 
i Guidance unit 


Warhead Engine/Propulsion Unit 


Fins/Control Surfaces 
















Antenna Autopilot/ 
Control Unit 





Body/Outer skin 
Engine 
Nozzle 


Figure 53: Generic form of a surface-to-air missile. (Source: Dutch Safety Board) 


There are three different types of fragmentation warhead; pre-formed, smooth and 
grooved or scored case. In a pre-formed fragmentation warhead, the case surrounding 
the explosive material is composed of one or more layers of pre-formed, separate, 
fragments closely packed together. This is different to the natural fragmentation of a 
smooth case and the controlled fragmentation of a grooved or scored case where the 
fragments are formed by the explosive force at the moment of detonation. The fragments 
of a pre-formed fragmentation warhead are arranged regularly around the circumference 
of the warhead. The fragmentation pattern created after the warhead’s detonation is a 
bounded fragment spray zone primarily consisting of pre-formed tragments. The damage 
caused by pre-formed fragmentation is different from that of natural and controlled 
fragmentation and is very distinct in that the pre-formed fragments give a regular pattern 
of fragment impacts within a bounded area on the structure of the target. 


In a warhead using pre-formed fragments, the separate fragments propagate from the 
detonation point in an expanding, divergent, ring-like pattern (see Figure 54). 
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Figure 54: Fragmentation pattern of a stationary, horizontal high-explosive fragmentation warhead detonation. 
(Source: The Fundamentals of Aircraft Combat Survivability Analysis and Design’, Robert E. Ball, 


reprinted by permission of the American Institute of Aeronautics and Astronautics, Inc.) 


Part B: 


Introduction to 
The fragmentation pattern consists of several sections. In simple terms, two patterns can ae 


be considered; the primary and the secondary pattern. After warhead detonation, the 
pre-formed fragments form the primary fragmentation pattern. The warhead is not 
located at the very front of the missile as it is behind the guidance, electronics, proximity 
fuse and seeker sections. Upon detonation of the warhead, these parts will disintegrate 


and create a secondary fragmentation pattern moving forward in a cone as shown in 


lah 
Figure 55. MUSE Col 
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Figure 55: Primary (red) and secondary (yellow) fragmentation pattern. (Source: Dutch Safety Board) 
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e MANPADS could not have caused damage to the aeroplane, because the altitude 
of flight MH17 (33,000 feet) cannot be reached by MANPADS. 

e Other, larger, types of surface-to-air missiles with fragmentation warheads are 
able to engage aeroplanes of the size and speed of a Boeing 777 at its cruising 
altitude. 


11 
e Pre-formed fragmentation warheads contain fragments of different shapes. 


Recommendations 





19 From Second Edition 2003, Figure 3.23 and 3.24. 
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3.6.4 Multiple weapon impacts 

The investigation also examined the available data and wreckage to address the 
hypothesis that the aeroplane was struck by more than one weapon. The damage to the 
forward part of the aeroplane requires that at least one surface-to-air weapon is a part of 
the scenario. Three scenarios are considered: 


e Two surface-to-air weapons struck the aeroplane; 
e A surface-to-air weapon and aerial cannon fire, struck the aeroplane; 
e A surface-to-air weapon and an air-to-air missile struck the aeroplane. 


The aeroplane’s wreckage showed that all of the high-energy objects that perforated the 
aeroplane originated from a single volume in space. No other witness marks were found. 
The hypothesis that a second surface-to-air weapon detonated near to a part of the 
aeroplane that was not recovered, i.e. wings or centre section, was discounted as the 
wreckage distribution described in paragraph 2.12.2 would be different as the break-up 
of a wing would affect the path that the damaged aeroplane followed. 


Finding 


Considering the wreckage distribution, the damage patterns and the fact that only 
once source of damage was found, the aeroplane was not struck by more than one 
weapon. 


3.6.5 Surface-to-air weapon systems common in the region 

In the previous paragraphs, air-to-air weapons and all surface-to-air weapons not having 
a pre-formed fragmentation warhead were excluded on the basis of the damage pattern 
found, the injuries sustained by three crew members in the cockpit, the fragments found 
and the wreckage distribution. This paragraph continues the analysis further by reviewing 
surface-to-air weapons with pre-formed fragmentation warheads that were, potentially, 
in use in the region. 


There are around twenty types of surface-to-air missiles common in the region that are 
capable of engaging a target at an altitude of 33,000 feet. All of these types use radar 
guidance and are equipped with a fragmentation warhead. Three systems, potentially 
relevant to the investigation, are noted in Table 15. 


Missile (typical) SV55 5V28 9M38/9M38M1 
Warhead mass (kg) 130 220 70 


Fragment shape and Cubic (5x 5x5) Mix of round balls (9 and Mix of cubic (8x 8x5 
size (mm) 12) and 6x 6x 8.2) and 
bow-ties (13 x 13 x 8) 













Table 15: Typical surface-to-air weapon systems in the region. 
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It is noted that the shapes of the pre-formed fragments found in the wreckage and the 
bodies of crew members in the cockpit; bow-tie and cubes, are only found in the 9N314M 
warhead (see Figure 56). The 9N314M warhead can be fitted to the 9M38M1 missile. 
These missiles are launched from a Buk surface-to-air missile system (see Figure 57). 


SH s44i 


12- 52-88 
Tr -24 





Figure 56: Left: Sample 9N314M warhead. (Source: JSC Concern Almaz-Antey). Centre: from top to bottom, 
square, bow-tie and filler fragments. (Source: JSC Concern Almaz-Antey). Right: 3D print of the 
pre-formed fragment arrangement. (Source: AAIB). Note: the model name for the 9N314M 
warhead is shown on the left hand image in Cyrillic text, ‘PH314M’. 


The Buk surface-to-air missile system is present in this region and is the only weapon 
system whose missiles have warheads containing, among other fragments, pre-formed 
fragments in the shape of a bow-tie in its warhead. 


The Buk is a medium range, mobile weapon system equipped with semi-active radar 
guided missiles. Its generic designation in the Russian Federation is 9K37 and its NATO 
designation is SA-11. The Buk became operational in 1979 and has since then gone 
through several upgrades. The system was designed in the former Soviet Union as a 
further development of its predecessor, the 2K12 Kub missile system (NATO designation, 
SA-6). 


According to the manufacturer of the Buk surface-to-air missile system, JSC Concern 
Almaz-Antey, the oldest version of the missile system (Kub) and the latest version (Buk-M2 
series) could not have been used because they are not equipped with a 9N314M warhead. 
According to the Kyiv Research Institute for Forensic Expertise of the Ministry of Justice, 
both the 9M38 and 9M38M1 missiles can carry the 9N314M warhead (see Table 16). 
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Figure 57: A typical Buk surface-to-air missile system. (Source: Dutch Safety Board) 
Normally, the system operates as unit of several vehicles, consisting of: 


e one Target Acquisition Radar; 

® one Command Post; 

e several Transporter Erector/Launcher and Radar vehicles; 
e several Transporter/Erector/Launcher and Loader vehicles; 
e technical, maintenance and other support vehicles. 


The Target Acquisition Radar will search for and detect targets. Once a target has been 
detected by the Target Acquisition Radar, the fire control radar in the Transporter/ 
Erector/Launcher and Radar vehicle can acquire and track the target. Once in range, a 
missile from the Transporter/Erector/Launcher and Radar vehicles can be launched to 
engage the target. However, each Buk Transporter/Erector/Launcher and Radar vehicle is 
equipped with its own fire control radar, allowing the vehicle to search for and engage 
with a target independently. 
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Warhead 9N314M 
9M38 9M38M1 
Teta, 
Buk Buk M1 Buk M1-2 
Designator 9K37 9K37M 9K37M1-2 
NATO code SA-11 SA-11 SA-11 
: 1979 1983 1988 
Year introduced ra 





2 Factual 


Table 16: Relevant combinations of missile and warhead on the Buk surface-to-air missile system. , 
information 


Buk operating characteristics 


e The missiles used by the Buk, the 9M38 and 9M38M1 missiles, are all about 5.55 m 


: , : Part B: 
long, weigh about 700 kg and use semi-active radar homing with proportional- Ria ie ~ 
navigation guidance. In semi-active radar homing systems the active tracking radar laa) 


on the ground illuminates the target with a beam of radar energy. The passive 
radar seeker in the nose of the missile tracks the radar energy reflected off the 
target. Proportional-navigation guidance systems use the target tracking 
information obtained from the seeker, to steer the missile directly towards the 
collision point with the target. If the target does not change its direction or velocity, 

the missile will follow a more or less straight path towards this collision point. B Sraeteade es 

e The Buk surface-to-air missile system is able to engage targets at altitudes up to 
70,000 or 80,000 feet. 

e The Buk system's missiles (the 9M38 and 9M38M1 missiles) are equipped with 
both an impact and a proximity fuse. The impact fuse detonates the warhead 
when the missile directly hits the target. However, in most cases the missile will 
not directly hit the target but pass closely by the target. eee 


7 Flying over 
Ukraine 


The Buk system's missiles (the 9M38 and 9M38M1 missiles) carry a 70 kg high-explosive 
fragmentation warhead, composed of a high-explosive detonator surrounded by layers 
of pre-formed fragments. The 9N314 and 9N314M warheads are composed of two layers 
of pre-formed fragments. The inner layer of pre-formed fragments in the 9N314M es 
warhead is composed of bow-tie shaped fragments together with square shaped ‘filler’ 9 Assessing the 
fragments. The outer layer consists of larger square shaped fragments (see Figure 56). oe 

On detonation, the warhead’s casing will shatter into irregularly shaped pieces. 
Information, provided by JSC Concern Almaz-Antey, regarding the pre-formed fragments 


used in the Buk surface-to-air weapon system is shown in Table 17. 


a 
Recommendations 
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Term 9IN314M 


In this report, based on information of JSC Concern Almaz-Antey, the term 9N314M 
is used to describe a 70 kg high-explosive fragmentation warhead with pretormed 
bowtie and square shaped fragments. 





mm) 














Dimensions ( Gomes iS OclS pce Oxo Xa 

Mass (grams) 2.35 8.10 2.10 

Proportion in warhead* ca. half ca. quarter ca. quarter 

Composition unalloyed steel unalloyed steel unalloyed steel 
Ec 

Dimensions (mm) Sxe x5 13 x 13x 8 

Mass (grams) 2.35 10.50 

Proportion in warhead* | ca. three-quarters ca. quarter 

Composition unalloyed steel unalloyed steel 


* Approximation made by the Dutch Safety Board. 


Table 17: Pre-formed fragments in warheads used in Buk surface-to-air missile systems. (Source: JSC Concern 


Almaz-Antey) 


The total number of pre-formed objects in a 9N314M warhead is, according to the 
Russian Federation defence group, JSC Concern Almaz-Antey, between 7,000 and 8,000. 


Findings 


e The 9N314M warhead carried on the 9M38-series of missiles as installed on the 
Buk surface-to-air missile system contains bow-tie, filler and square pre-formed 
fragments. 

e The missiles launched by the Buk surface-to-air missile system can reach targets 
up to an altitude of 80,000 feet. 
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3.7. Source of the damage 


This Section brings the various parts of the analysis and the underlying factual information 
together to identify and confirm the origin of the fragments that struck the aeroplane at 
13.20:03 (15.20:03 CET). 


The sound peaks recorded on the Cockpit Voice Recorder gave a clear indication that at 
13.20:03 (15.20:03 CET) a high-frequency sound originated at a point above and to the 
left of the cockpit. The fact that the ditferent Cockpit Voice Recorder microphones each 
recorded the sound wave at a slightly different moment provided confirmation that the 
sound wave moved from left to right. Paragraph 3.4.1 showed that the sound wave was 
recorded on the left hand microphone before it was recorded on the one furthest to the 
right. 


The high-frequency sound recorded on the Cockpit Voice Recorder is the sound of a 
pressure wave associated with an explosion. 


The damage observed on the forward fuselage and cockpit area of the aeroplane 
indicated that there were multiple impacts from a large number of fragments from 
outside the aeroplane. The maximum density was over 250 witness marks per square 
metre. A small amount of damage was also observed to the left engine intake ring and 
the left wing tip (see Section 2.12). 


There was also evidence of pitting and burning (soot deposits) near to the outside of the 
left cockpit windows. These parts of the wreckage showed traces of explosive residues. 
Two windows panels that were recovered showed signs of having been exposed to heat. 
In addition to the evidence of pitting and burning near to the outside of the left cockpit 
windows, some fuselage panels on the right hand side of the fuselage showed signs of 
having been deformed by the effects of a high pressure wave (blast). See paragraph 3.5.3. 


Many small fragments were found in the bodies of three crew members that, at the time 
of the crash, were in the cockpit. Fragments were also found in the wreckage of the 
aeroplane. Three fragments, made of unalloyed steel, had a distinct bow-tie or cubic 
shape. Such fragments were not found in the bodies of any other victims. Also, one 
fragment extracted from the cockpit wreckage had this distinctive bow-tie shape (see 
Sections 2.13 and 2.16). Bow-tie shaped fragments are found in the 9N314M warhead. 


The in-flight break-up sequence of the aeroplane’s structure indicated that the cockpit 
separated immediately following the detonation of a warhead. 


Using the shape and orientation of the witness marks, including the perforation holes in 
the left engine intake ring and left wing tip, a trajectory direction was derived. The results 
show trajectories of perforation damage converging to a single source to the left of, and 
above, the cockpit. 


Foreign objects were recovered from the cockpit and the left wing tip. These objects 
were examined. As part of the criminal investigation, paint samples taken from missile 
parts found in the wreckage area match those found on these foreign objects. 


ie = y 4 136 01 277 












Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 
7 Flying over 
Ukraine 


Part B: 
9 Assessing the 
aL « 


ai 
Recommendations 


16 
List of appendices 


Notwithstanding the possibility of sample degredation and contamination, some of the 
wreckage parts and the missile part recovered showed traces of explosive residues (e.g. 
RDX). The results were provided to the Dutch Safety Board (see Sections 2.12 and 2.16). 


Findings 


The combination of the recorded pressure wave, the damage pattern found on the 
wreckage caused by blast and the impact of fragments, the bow-tie shaped 
fragments found in the cockpit and in the body of one of the crew members in the 
cockpit, the injuries sustained by three crew members in the cockpit, the analysis of 
the in-flight break-up, the analysis of the explosive residues and paint found, and the 
size and distinct, bow-tie, shape of some the fragments, led the Dutch Safety Board 
to conclude that the aeroplane was struck by a 9N314M warhead as carried on a 
9M38-series missile and launched by a Buk surface-to-air missile system. 


3.8 Simulations to assess the origin of the damage 


3.8.1 Introduction 

Using the results in Section 3.7 that the aeroplane was struck by a warhead, a number of 
simulations were run. These were intended to corroborate the findings and to calculate 
the volume of space of the warheads detonation location and the missile’s possible flight 
path from the ground to detonation. Simulations performed by three parties delivered 
results that were consistent with the damage observed on the aeroplane’s wreckage. A 
study provided by the Russian Federation had results that were not consistent with the 
damage. More information on this matter is contained in Appendix V to this report and 
in the report ‘MH17-About the investigation’. 


NLR performed two studies to verify that the damage observed on the wreckage could 
originate from a 9N314M warhead. The studies were a fragmentation visualisation model 
and a missile flyout simulation. TNO used, independently, its terminal ballistics simulation 
to verify that the damage observed on the wreckage could originate from a 9N314M 
warhead. As part of this work, alternative warhead loads and detonation positions were 
simulated. In addition to the above work, TNO simulated the blast loading that the 
detonation of the warhead exerted on the aeroplane. To this end, a computational fluid 
dynamics simulation of the detonation was performed by TNO. More informative about 
these simulations can be found in Appendices X, Y and Z. 


On behalf of Ukraine, the Kyiv Research Institute for Forensic Expertise of the Ministry of 
Justice and military experts of the Ukrainian Defense Ministry provided the results of 
their simulations performed regarding the origin of the damage. 


3.8.2 Fragmentation visualisation model 

A simulation model of the location and the boundaries of the damage on the fuselage of 
the Boeing 777 was constructed by NLR, using the primary fragmentation pattern of the 
9N314M warhead, the known speed of the aeroplane and a three dimensional model of 
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a Boeing 777. Light was used to visualise the area of the fuselage exposed to the primary 
fragments of the warhead (see Figure 58). This fragmentation visualisation model was 
used to compare the actual high-energy object damage on the cockpit with the 
calculated fragment spray of the warhead from the point of view of detonation location, 
boundary and impact angle. The full report is published in the on-line appendices on the 
Dutch Safety Board’s website (Appendix X). 


The simulation model resulted in a detonation location of the warhead that was to the 
left of and above the cockpit, whereby the missile was travelling at a speed of 
approximately 700 metres per second (approximately 1,360 knots or 2,520 kilometres 
per hour) in the opposite direction to the direction of flight of the aeroplane, coming 
slightly trom below and from the right with respect to the aeroplane’s longitudinal axis, 
seen from the cockpit. 





Figure 58: Expected damage pattern caused by a 9N314M-model warhead. Lit areas show where damage was 
expected. (Source: NLR) 


Using the modelled warhead's detonation point with the aeroplane’s last known location, 
speed and attitude (see paragraph 3.4.1), the fragmentation visualisation model matched 
the damage observed on the wreckage of the aeroplane. The estimated position of the 
detonation was 0.25 metres ahead of the aeroplane’s nose, 3 metres to the left of, and 
3.7 metres above the tip of the nose. 


The end speed of the missile at the moment of the warhead’s detonation was about 
700 metres per second. This indicates that the point of detonation was well below the 
missile’s ceiling. 

Findings 


Simulation showed that the observed damage and the modelled fragment pattern 
resulted in an estimated detonation location of the warhead to the left and above 


of the cockpit. 
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3.8.3 Warhead simulation 

Using the presence of a pre-formed fragmentation 9N314M warhead, TNO worked to 
analyse the possible trajectories of the high-energy objects that would emanate from the 
warhead. A summary of that work is discussed in this paragraph. The full report is 
published in the on-line appendices on the Dutch Safety Board's website (Appendix Y). 


Several runs of the simulation were performed using three different warheads varying in 
size, shape and explosive force. Table 18 shows the three warhead models used in the 





simulation. 
Ce 
Number of pre-formed fragments Unknown 1,825 bow-tie 1,870 bow-tie 
1,825 filler 1,870 filler 
4,093 square 4,100 square 
Minimum ejection angle (degrees) fz 76 68 
Maximum ejection angle (degrees) 109 112 126 
Lowest fragment speed (m/s) circa 1,700 circa 1,300 circa 1,110 
Highest fragment speed (m/s) circa 2,300 circa 2,520 circa 2,460 





Table 18: Warhead models used by TNO in the warhead simulation tool. 


The following consideration was included in the simulation; fragmentation damage is 
dependent on the distance of an aircraft from the warhead, the orientation of the aircraft 
relative to the cloud of fragments and their impact velocity. The impact velocity is 
determined by the vector sum of the warhead’s speed, the ejection velocity of the 
fragments and the speed of the aircraft. Fragments encounter deceleration through the 
atmosphere and perforating the aircraft structure, losing kinetic energy with each 
subsequent perforation of material. 


This warhead simulation was intended to compare the outcome with the actual damage 
observed. Multiple runs of the simulation were performed using different warhead 
characteristics (e.g. mass and number of pre-formed fragments), weapon approach 
speed and angles. The warheaad’s determined position at detonation took into account 
the time between detonation of the warhead and the impact of the fragments. The 
results of the simulation are shown in Table 19. 
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Simulation Weapon yb aE} Y-axis Vher WA Azimuth (°) Elevation 
case end speed (metres) (metres) (metres) (°) 
(m/s) 
Model la circa 600 -0.4 -3.5 257 -17 7 
Model Ib circa 600 -0.7 -2.0 os -35 10 
Model lla circa 600 0.0 -2.0 Bel, -30 sy 
Model IIb 70 0.0 -2.0 eu -27 10 
Model Illa circa 600 0.5 =e 3.4 -27 10 
Model Illbb 730 0.5 -2.3 S25 -24 7 
Model Illc 730 1.4 -0.8 50 -72 a 











Table 19: TNO Simulation results. Note: The simulation of warhead model Illc was performed using data 
provided to TNO by JSC Concern Almaz-Antey. 


The best-match (green band in Table 19) between the simulation and the damage 
observed on the aeroplane was obtained with a 70 kg warhead flying at 730 metres per 
second and passing left of the aeroplane with an angle of 27 degrees to the aeroplane’s 
x-axis and with a nose up attitude of 10 degrees (model IIb). 


A visualisation of the results of model Ilb, the model that provided the best match with 
the damage described in paragraphs 2.12.2.3 and 2.12.2.7, is shown in Figure 59. 





Figure 59: Image of the damage pattern produced by the model IIb in the warhead simulation model. (Source: 
TNO) 
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Based on its calculations, TNO concluded that a 70 kg warhead detonated 0.0 metres 
ahead and 2.0 metres to the left of, and 3.7 metres above the aeroplane’s nose. 


TNO’s simulation also showed that there is no match obtained between the observed 
damage on the aeroplane and the simulated damage patterns when a smaller and lighter, 
40 kg, warhead was applied. Figure 60 shows the simulated damage patterns for the set 
of simulations with a 40 kg warhead which were closest to the actual observed damage. 
This pattern gave a poorer match than was obtained with a heavier warhead (Model IIb). 
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Figure 60: Image of the damage pattern produced by the model of a 40 kg warhead in the warhead simulation 
model. (Source: TNO) 


Serene Part B: 
Finding 9 Assessing the 
aL « 


Simulation demonstrated that a 70 kg warhead best matched the damage observed 
on the wreckage of the aeroplane. 


3.8.4 Ukrainian study i 

Based on the Ukrainian simulations, performed by the Kyiv Research Institute for Forensic Recommendations 
Expertise of the Ukrainian Ministry of Justice and the military experts of the Ukrainian 
Defense Ministry, it was concluded that a 9N314M warhead detonated at approximately 
4 metres to the left of and above the tip of the aeroplane’s nose. 
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3.8.5 Volume of space containing the detonation positions 

The results of the simulations performed by NLR, TNO and the Kyiv Research Institute for 
Forensic Expertise described in the paragraphs above were consistent with each other. 
The distance from the tip of the aeroplane’s nose to the point where, according to these 


simulations, the detonation took place is shown in Table 20. 


ars NEY are D AE 
(- = ahead of nose) (- = left side) 





TNO 0.0 -2.0 on 
NLR -0.25 -3.0 oT 
Kyiv Research Institute for Forensic Expertise 0.0 -4.0 4.0 
JSC Concern Almaz-Antey (see note) -0.40 -3.5 S.7 





Table 20: Summary of detonation positions (distance in metres). Note: The data provided by JSC Concern 
Almaz-Antey used information that TNO had initially calculated and was included in the draft Final 
Report sent to the Annex 13 partners for consultation in June 2015. As part of that consultation, 
TNO updated its calculated position to the one shown in the table. The Russian Federation provided 
this data to the Dutch Safety Board without confirming that a 9N314M warhead, carried by a 9M38- 


series missile and launched from a Buk surface-to-air missile system, had caused the crash. 


The Dutch Safety Board took account of uncertainties in the models by defining a volume 
of space that enclosed the results of the different simulations instead of a finite point in 
space. The volume of space of the warhead’s detonation locations shown in Figure 61 is 
less than one cubic metre and is located at approximately 4 metres above the tip of the 
aeroplane’s nose on the left side of the cockpit. 
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Not to scale 





Figure 61: Simplified representation of the volume of space of the warhead detonation location according to 


three independent simulations. (Source: Dutch Safety Board) 


Finding 


The simulations performed indicated that the location of the explosion of a 9N314M 
warhead was in a volume of space that is less than one cubic metre and about four 
metres above the tip of the aeroplane’s nose on the left side of the cockpit. 


3.8.6 Simulations of the missile’s flight path 
The investigation into the detonation of the warhead included fly out simulations which 
also comprised the weapon's possible flight paths. NLR, Ukraine, and JSC Concern 


Almaz-Antey performed simulations to calculate the missile’s flight path based on the 
detonation positions calculated in the simulations as described in paragraph 3.8.5. These 
simulations are described below, commencing with the work performed by NLR. 


Using a data set that simulated the characteristics of both the Boeing 777 and a 9M38- 
series missile armed with a 9N314M warhead, fly out simulations were conducted to 
assess the possible flight paths back from the volume of space of detonation locations to 
the ground. Numerous missile launches were simulated over a grid on the ground, 
independently of the launching platform. At each location, missile launch angles in the 
horizontal and vertical plane were varied. In these simulations, a number of uncertainties 
were accounted for. These included uncertainties in weapon performance and guidance, 
orientation angles and airspeeds. This allowed the possible flight paths to be calculated 
that matched the end conditions associated with the detonation location in the volume 
of space. 


All of the possible points from where these flight paths could have commenced are 
visualised in Figure 62. Outside the calculated area of about 320 square kilometres, a 
9N314M warhead carried on a 9M38-series missile as installed on the Buk surface-to-air 
missile system cannot create the damage pattern observed on the aeroplane. 
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Figure 62: Visualisation of NLR fly out simulation results. (Source: NLR) 
In a simulation performed by the Kyiv Research Institute for Forensic Expertise, an area 


of 4 square kilometres was calculated using the 9M38M1 missile and 9N314M warhead. 
This is shown in Figure 63. 















Google 


Figure 63: Visualisation of Kyiv Research Institute for Forensic Expertise fly out simulation results. (Source: Kyiv 


Research Institute for Forensic Expertise) 


JSC Concern Almaz-Antey performed a simulation of the effects that would be expected 
from this weapon using detonation data that TNO had calculated and was included in 
the draft version of this report. This was done without confirming that a 9N314M warhead, 
carried by a 9M38-series missile and launched from a Buk surface-to-air missile system 
had caused the crash. The material provided by JSC Concern Almaz-Antey was used by 
the investigation as a validation of the models used by NLR and Kyiv Research Institute 
for Forensic Expertise. 


Results for sets of similar calculations were supplied; one for a warhead launched by a 
9M38 missile and one for the same warhead launched by a 9M38M1 missile. These 
calculations produced two areas, respectively, approximately 20 and 63 square 
kilometres. The areas calculated by JSC Concern Almaz-Antey (see Figure 64) are 
consistent with the results of the NLR and Kyiv Research Institute for Forensic Expertise 
calculations. 
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Figure 64: Visualisation of JSC Concern Almaz-Antey fly out simulation results. Note: The red line, numbered 1 
to 4, marks the initial area identified by the NLR fly out simulation; an area since updated. (Source: 


JSC Concern Almaz-Antey) 


The results of the three sets of simulations are shown in a combination sketch (see Figure 
65) of the calculated areas from which a 9N314M warhead carried on a 9M38-series 
missile as installed on the Buk surface-to-air missile system could have reached the 
warhead’s detonation location in the volume of space near to flight MH17 and could have 
created the damage observed. 
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Whilst the results of the three studies all point to a similar geographic area, further 
forensic research is required. Such work falls outside the mandate of the Dutch Safety 
Board, both in terms of Annex 13 and the Kingdom Act ‘Dutch Safety Board’. 


Findings 


e The area from which the possible flight paths of a 9N314M warhead carried on a 
9M38-series missile as installed on the Buk surface-to-air missile system could 
have commenced is about 320 square kilometres in the east of Ukraine. 

e Further forensic research is required to determine the launch location. Such work 
falls outside the mandate of the Dutch Safety Board, both in terms of Annex 13 
and the Kingdom Act ‘Dutch Safety Boara’. 


3.9 Blast damage 


By reviewing the observed damage on recovered parts of the aeroplane and by 
investigation of the blast pressure evolution for a number of discrete points on the 
aeroplane’s contour, the effects of the blast of the warhead was analysed. This was 
achieved by means of a so-called computational fluid dynamics simulation performed to 
provide a high-fidelity quantitative description of the blast loading. The computational 
fluid dynamic simulation takes into account the altitude, properties of the 9N314M 
warhead, velocity of the aeroplane, velocity of the warhead, and shape of the aeroplane. 
The position and orientation of the detonating warhead relative to the aeroplane was 
taken from paragraph 3.8.3, model IIb. 


Blast damage is highly dependent on the distance from the warhead, the orientation of 
the aircraft part (so that it receives an incident or reflected blast) and the speed of the 
aircraft. Blast has the following effect on aircraft structures, in increasing intensity: 


e Compression of skin panels between frames and stiffeners where the skin does not 
tear, and frames and stiffeners do not distort. This is known as dishing; 

e Deformation of trames and stiffeners and detachment of skin panels, and 

e Tears of skin panels and stiffeners. 


Blast damage can be masked by perforation damage, damage caused by the break-up 
of the aircraft and its impact with the ground. Of all the typical blast damage forms, 
dishing is, in this situation, the most easily visually detected. Depression of skin panels 
can also be caused by bending of aircraft parts during the break-up and impact with the 
ground. Several depressions were found on the wreckage that could not be linked, with 
sufficient certainty, to dishing. 


The cockpit area had a considerable number of witness marks that provide an indication 
of blast damage. The panel below the left hand cockpit windows is damaged by pitting 
and showed traces of soot (see paragraph 2.12.2.7). The pitting damage is local and is 
considered to be the result of hot fragments of a warhead detonating close by; evidence 
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of blast. Another piece of evidence for the presence of blast was found in the 
discolouration of the two left cockpit window parts that were recovered. Their exposure 
to air and heat, changed the plastic from clear to opaque. 


Blast extends initially soherically after the detonation of a warhead. However, blast can 
flow around obstacles and also cause damage behind an obstacle. This makes it possible 
for blast damage on the right hand side of the aeroplane to occur after detonation on 


the left hand side. As shown in Figure 51, blast damage was observed forward of STA230 
on the right hand fuselage skin. The fuselage skin at STA230 marked the limit of the blast 


damage area. The lower part of this part of the fuselage was highly distorted, probably aa 

yaar Xoa tT) 
by the break-up of the aeroplane and impact with the ground. areata 
The floor part to the left of and below the captain's seat was recovered with part of the 
flight control mechanism on that side. It is holed extensively, and also shows clear 
evidence of the effects of an explosion, indicating that this area was close to the 


detonation point. 
Part B: 


Introduction to 
Once the pressure hull of the aeroplane was compromised by the impact and perforation ae 


of the high-energy objects, the cabin depressurised due to the large number of holes in 


the aeroplane. 
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Figure 66: Sample image of blast simulation showing blast wave around fuselage, 7.2 milliseconds after PP 


detonation. (Source: TNO) Recommendations 


Calculations show how peak pressure decreases with increasing distance. The blast 
following the detonation of the warhead created an area of very high pressure near the 
cockpit with a maximum value of about 5,000 kilopascals. 75 kilopascals was taken to be 
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the threshold for the mildest form of blast damage on the aeroplane structure. At a 
distance from the aeroplane’s nose of 12.5 metres the pressure drops below 75 kilopascals. 
Pressure kept decreasing until the effect of the blast became negligible at approximately 
35 metres from the aeroplane’s nose. 


The damage to the wreckage recovered was consistent with the predictions made by the 
blast simulation. 


Findings 


e The simulation of the blast following the detonation of the 9N314M warhead 
created an area of very high pressure near the cockpit with a maximum value of 
about 5,000 kilopascals. 

e Damage to the aeroplane’s structure as the result of pressure is caused with 
values in excess of 75 kilopascals. Such damage could only be caused along the 
fuselage for 12.5 metres from the detonation point. 

e The damage to the wreckage recovered was consistent with the predictions 
made by the simulation of the blast caused by the detonation of a warhead. 


3.10 Summary of the results of the simulations into the causes of the 
crash 


In Section 3.7 the Dutch Safety Board concluded that, on the basis of the combination of 
findings of the recorded sound, the damage pattern found on the wreckage caused by 
blast and the impact of fragments, the bow-tie shaped fragments found in the cockpit 
and in the body of one of the crew members in the cockpit, the injuries sustained by 
three crew members in the cockpit, the analysis of the in-flight break-up, the analysis of 
the explosive residues and paint and the size and distinct, bow-tie, shape of some of the 
fragments, the aeroplane was struck by a 9N314M warhead as carried on a 9M38-series 
missile and launched by a Buk surface-to-air missile system. 


A number of simulations were run to corroborate these findings. In these simulations the 


specifications mentioned in Section 3.6 were used. These simulations led to the following 
findings: 
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Findings 


e Simulations showed that the observed damage and the modelled fragment 
pattern resulted in an estimated detonation location of the warhead to the left 
and above of the cockpit. 

e Simulations demonstrated that the detonation of a 70 kg warhead best matched 
the damage observed on the wreckage of the aeroplane. 

e The simulations performed indicated that the detonation location of a 9N314M 
warhead was in a volume of space that is less than one cubic metre and about 
four metres above the tip of the aeroplane’s nose on the left side of the cockpit. 

e The damage to the wreckage recovered was consistent with the predictions 
made by the simulation of the blast caused by the detonation of a 70 kg warhead. 


The above mentioned findings are consistent with the conclusion of the Dutch Safety 
Board that flight MH17 was struck by a 9N314M warhead as carried on a 9M38 series 
missile and launched by a Buk surface-to-air missile system. 


3.11. The in-flight break-up and its aftermath 


3.11.1 Introduction 

As part of the failure analysis, the structural fractures of the wreckage pieces were 
examined. The purpose of this analysis was to determine whether there was pre-existing 
damage that had initiated or contributed to the in-flight break-up. For that purpose 
possible fatigue, mechanical damage, corrosion or repairs were looked after. A second 
objective was to determine where on the aeroplane the failure had initiated. Descriptions 
of types of failure found on the wreckage parts have been included in Appendix L. 


Structural fractures at specitic locations were examined, namely the boundaries between 
the four main parts of the aeroplane’s structure that have been recovered: 


° cockpit and front fuselage; 
e centre fuselage; 

e rear fuselage; 

e tail. 


The failure analysis was limited to the wreckage parts that had been recovered. 


3.11.2 The separation of the cockpit and front fuselage from the centre fuselage 
The cockpit and the front fuselage separated at approximately STA888 from the centre 
fuselage. Fractures in the cockpit and the forward fuselage were examined because 
these fractures indicate the start of the break-up. 


Multiple perforations were present in the cockpit region (i.e. forward of STA236.5). The 
left hand side of the cockpit was fractured into small pieces. Therefore, the perforations 
had probably acted as crack initiation sites. Due to the presence of these perforations, 
the fractures in the cockpit region could not be analysed. 
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The other main fractures in the front fuselage are shown in Figure 67. These fractures are 
numbered (1 up to and including 20). 
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Figure 67: Front fuselage left hand side (bottom) and right hand side (top) view with main fracture lines and 
fracture growth directions. The arrows represent the growth direction. The lack of an arrow besides 
(part of) a fracture indicates that the growth direction could not established. Frame locations are 


indicated by STA numbers. (Source: Dutch Safety Board) 


The most probable in-flight break-up sequence of the cockpit and front fuselage is 
assumed as follows: 


Fractures 11 and 12 along STA236.5 can be associated with the initial direct blast wave 
due to their proximity to the cockpit and initial blast location. The horizontal fractures at 
the level of the passenger floor running aft (fractures 1, 2 and 13), caused a separation of 
the top part from the lower part of the front fuselage with the cockpit. The circumferential 
fractures at STA655 (fractures 7, 16 and 18) indicate a complete separation of the fuselage 
part in front of it. 


The fractures in the upper part at STA655 (fractures 7 and 16) propagating upward 
indicate an upward bending moment acting on upper front parts and a separation of 
upper parts in upward direction. The fractures in the lower part at STA655 (fracture 18) 
and on the left hand side between STA529 and STA613 (fractures 5 and 6), propagating 
down indicate a downward bending moment acting on the part below the passenger 
floor plus cockpit and a separation of these parts in downward direction. 
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Following this separation, several longitudinal fractures developed in the fuselage part 
from STA655 until STA888/909, (fractures 8, 9, 17, 19 and 24) propagating to the rear, 
caused radial opening of it and locally peeling of the skin from stringers and frames. The 
other fractures between STA655 and STA888/STA909 were consistent with the radial 
opening of the fuselage due to aerodynamic loads. Finally this fuselage part separated 
from the centre fuselage behind it between STA888 and STA930, see Figure 68. 
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Figure 68: Observed position of fracture at STA 888/909 and type of loading of the fracture at STA888/909. 
Only between stringers 45R and 39R parts from the front and the centre fuselage fitted together. In 
the figure the thick line indicates this location. (Source: Dutch Safety Board) 


3.11.3 Separation of the rear fuselage from the centre fuselage 

The rear fuselage separated from the centre fuselage at approximately STA1546. This 
location coincides with the aft door frame of passenger doors 3L and 3R. The radial 
fractures between the centre part and the rear part of the fuselage were consistent with 
tensile and bending loading. A large skin panel on the left upper side of the fuselage, 
extending from half way the main landing gear wheel bay in front of doors 3L and 3R to 
about 1.5 meters aft of doors 3L and 3R, was found at the same location as the parts of 
the rear fuselage (in wreckage site number 4). This part probably separated just before 
the fuselage rear part broke away. As this part separated, the section at the doors was 


weakened. 
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Figure 69: Examples of tensile overstress fracture at passenger doors 3L and 3R. (Source: Dutch Safety Board) 
The weakened fuselage section then broke and the rear part separated. 


3.11.4 Separation of the tail from the rear part of the fuselage 

The tail separated from the rear part of the fuselage at approximately STA2174. All 
fractures investigated here showed signs of out-of-plane bending, mostly combined with 
tensile loadings. 





Figure 70: Left hand side separation fracture between rear fuselage and the tail. Separation is at the irregular 
fracture indicated by the black line. The vertical cut through the left letter M was made for 
transportation purposes. (Source: Dutch Safety Board) 
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3.11.5 Fractures in specific parts 
Also, fractures in a number of specific parts were examined. 


Rear pressure bulkhead 

The curved rear pressure bulk head was fractioned and severely deformed. Figure 71 
shows the fractures in the dome and the parts that were recovered, namely major 
sections with clear intersection with the dome centre part (parts numbered 1, 2, 6 and 8) 
and four smaller pieces intersecting with the fuselage structure (parts numbered 3, 4, 5 
and 7). 


The fractures in circumferential direction followed the intersection with either the 
fuselage, or with the tear straps. These fractures are predominantly consistent with a 
tensile overstress fracture in the net section. In addition, circumferential fractures were 
observed at the connection to the centre part of the dome. Also these fractures surfaces 
were consistent with overstress fractures as result of combinations of tension and out of 
plane bending. Fractures in a radial direction were observed also consistent with tensile 
overstress fractures. These fractures follow the fastener row underneath the radial 
stiffeners. 





Looking aft 


Figure 71: Fractures in rear pressure bulkhead. Looking aft. The parts that were available for investigation are 


numbered 17 to 8. (Source: Dutch Safety Board) 
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The fractures observed in the bulkhead were consistent with tensile overstress, caused Foreword 


either by a pressure difference or a disintegrating fuselage structure, where a relatively 
flexible, thin walled dome is pulled apart by the surrounding fuselage structure. 
Summary 


There are no indications of a sudden failure by overpressure of the rear pressure bulk 


head. 





1 


The observed fracture pattern indicated that most probably the pressure bulkhead was eo eeeD 


torn apart by the fuselage breaking up. 


Part A: 
Cargo doors Se apie: 
information 


The front cargo door was recovered at wreckage site 3 in closed position. The rear cargo 





door had separated from the aeroplane. It was recovered at wreckage site 4. This 
Part A: 


indicates it separated relative late in the sequence (of events) with the other parts of the auAnalveie 


rear fuselage. It can be ruled out that the opening of the cargo doors contributed to the 


crash. 
Part B: 
Introduction to 
Wing tips laa 





Both wing tips separated from the remaining wing structure. Both ailerons were not 
recovered. Fracture patterns led to both a downward acting bending moment and the Part B: 
likelihood of a relative high torsion moment at the separation area. 4 Decision making 


Vertical stabilizer 


, ye a 
The vertical stabilizer separated from the rear fuselage. Parts of the main frame were eee 





found connected to it. The fractures are consistent with lateral loads acting on the fin 
oriented to the aeroplane right hand side, causing a bending moment and a torsion 


moment at the connection to the fuselage, resulting in separation of the fin. Part B: 
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Figure 72: Overload failure of the vertical stabilizer. (Source: Dutch Safety Board) 
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Figure 73: Fracture separating the vertical stabilizer from the fuselage. Attached skin and broken vertical 


stabilizer-to-fuselage frames bended out of their plane and fractured. (Source: Dutch Safety Board) 


Horizontal stabilizers 

The horizontal stabilizers had separated from the centre part just outside the fuselage. 
Only the centre horizontal stabilizer part and the left hand horizontal stabilizer were 
available for investigation. The fractures in the left horizontal stabilizer were consistent 
with a downward bending moment acting in the separation plane. This moment was 
caused by a downward acting loading on the horizontal stabilizer. Failure of the elevator 
attachment brackets and power control units were consistent with high aerodynamic 
loads acting on the elevator. 


Main landing gear 

The Flight Data Recorder data indicated that the main landing gear was in the retracted 
position at the last recorded position of the aeroplane. Pictures taken on the crash site a 
few days after the crash indicate that the right hand retract actuator of the main landing 
gear was close to its retracted (gear-up) length. Therefore it can be concluded that the 
landing gear was in the retracted position when the event occurred. 


Finding 
None of the investigated wreckage parts showed indications of the presence of pre- 


existing damage, such as fatigue, corrosion or inadequately performed repairs. 


3.11.6 External damage exacerbated by airworthiness aspects 
In paragraph 3.2.2, a number of airworthiness aspects were analysed and excluded as 
being the cause of the crash. For completeness, a final hypothesis was also considered; 
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that the aeroplane was not sufficiently damaged by surface-to-air missile to cause it to 
crash, but that the crash was the result of a combination of the pre-formed tragment 
damage and one or more pre-existing technical failures or deficiencies. 


The comprehensive structural analysis of the failure modes of the fuselage described in 
paragraphs 3.11.2 to 3.11.5 showed no evidence of fatigue, pre-existing damage or repairs 
that could have played a contributing factor to the crash. None of the systems, as recorded 
by the Flight Data Recorder, showed a defect that could have exacerbated the effects of 
the damage caused by the high-energy objects. The maintenance records for the aeroplane 
following its last major overhaul, in November 2013, did not reveal any defect that had not 
been rectified adequately. None of the deferred defects at the time of the crash could 
have exacerbated the effects of the damage caused by the pre-formed fragments. 


Finding 


The effects of the damage caused by the pre-formed fragments were not 
exacerbated by any technical issue. 


3.11.7 Ballistic trajectory analysis 


3.11.7.1 Introduction 
This Section describes the in-flight break-up of the aeroplane, its sequence and the 
trajectory after impact. 


The distribution of wreckage parts over the crash area given in Section 2.12 shows there 
are six wreckage sites numbered 1 through 6. The figures in Section 2.12 show that the 
debris field can be divided roughly in two areas: one (sites 1, 2 and 3) relatively close to 
the last recorded FDR position, and one (sites 4, 5 and 6) relatively close together and 
further from that position and more or less in the direction of flight. 


As the wreckage sites 1, 2 and 3 are much closer than the sites 4, 5 and 6 to the last FDR 
position, it may be concluded that the wreckage parts which landed there separated 
much earlier from the aeroplane than those in sites 4, 5 and 6. The sites 4, 5 and 6 being 
relatively close together suggests that the time intervals between the separation of these 
parts from the aeroplane must have been relatively short and that the altitudes of 
separation were relatively low. 


The previous sections give the results of the investigation into the main fractures in the 
structure and the separations of different aeroplane parts. 


Figure 67 shows left and right side views of the front fuselage with the main fractures in 
the aeroplane structure. 
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As mentioned elsewhere in this report, no radar fixes or eye-witness statements on the 
moment of the in-flight break-up were available. As a result, the information available to 
make a reliable reconstruction of the flight path and the break-up sequence is limited. 
Only information from distribution of debris over the six wreckage sites is available. 


To obtain information about the moment of separation of some wreckage parts at a 
certain moment, a ballistic trajectory analysis was carried out. 


A ballistic trajectory analysis can be used to determine the trajectory through the air of an 
object that has no aerodynamic lift. Its trajectory is determined by its ballistic coefficient 
(BC), which is the weight of an object divided by the product of its drag coefficient with its 
cross-sectional area. Thus a feather (which has a very low ballistic coefficient) would fall 
slowly when released from an initial point in space, moving almost exclusively with the 
wind to the ground. In contrast, a bowling ball (which has a high ballistic coefficient) would 
fall rapidly, with very little displacement resulting from the wind. 


A ballistic trajectory analysis was performed for selected wreckage parts recovered on 
the ground, with known starting conditions; the last recorded FDR position and time, 
flight altitude and airspeed. Using the known wind speed and directions from the ground 
until the cruise altitude, it was possible to determine the trajectories and thus the landing 
locations. More information about the method of ballistic trajectory analysis is found in 
Appendix K. 


3.11.7.2 Results of the ballistic trajectory analysis 

A ballistic trajectory analysis was performed for parts, with the following starting 
conditions: last known FDR position, time of last FDR recording, speed and altitude, 
taking into account the reported wind from cruise level to the earth. 


By running the ballistic trajectory analysis for multiple ballistic coefficients, a so-called 
locus line was obtained. The locus line represents the possible ground positions of 
wreckage parts after break-up, assuming that they all separated at the same initial 
position, altitude and speed and assuming a ballistic trajectory taking into account the 
wind, see Figure 74. 
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Sites 1, 2 and 3 


Legend 

— Road 

|_| Residential area 
~~~ Railway 

CJ Wreckage location 
@™@ Locus line 

[_} Textile roll location 


Site 1 
Upper left hand cockpit fuselage* 
Upper part fuselage above business 
class (forward)* 
Upper part fuselage above business 
class (aft)* 
Right hand fuselage with partial text 
“Malaysia” 
Left hand fuselage with positive 
pressure relief valves* 


Site 2 
Left hand fuselage with door frame of 
door 1L* 
Right hand fuselage with door frame of 
door 1R* 
Left hand fuselage with door frame of 
door 2L 
9. Lower fuselage with forward cargo floor 
10. Right hand fuselage with door 2R 
11. Left engine intake ring 
12. Left hand fuselage with impact damage 
13. Forward section passenger floor, 
business class 


Site 3 

14. Cockpit, including forward bulkhead, 
forward cargo hold, nose gear wheel 
bay, avionics 


Parts not retrieved by the Dutch Safety 
Board 


600 m A 
N 
Figure 74: Calculated locus line (black) from ballistic trajectory analysis with identified wreckage and cargo 


parts in sites 1, 2 and 3. (Source: Dutch Safety Board) 


From the cargo manifest it was established that ten textile rolls were transported on a 
pallet with position 21P (approximately STA700 - STA800); see Section 2.12. These textile 
rolls, once separated from its pallet, would have had a very low ballistic coefficient. From 
satellite imagery seven textile rolls, each containing 100 metres of textile, were identified 
in site 1 approximately 5 to 5.7 kilometres from site 3 (cockpit). It is of note that the 
textile rolls were identified on a satellite image dated 21 July 2014. Satellite imagery after 
this date did not show the textile rolls, but showed clear markings of agricultural work. 


In Appendix K, the Ballistic Coefficients of the textile rolls were calculated and they were 
as expected very low. This would mean that they would likely be found near the top end 
of the locus line if they separated from the aircraft at the point of initial break-up. As site 
1 is at the top end of the locus line where low Ballistic Coefficient pieces would be 
expected, this verifies the ballistic locus line calculation. 
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The combination of the cockpit with the lower fuselage part has a very high ballistic 
coefficient. This means it would likely be found near the lower end of the locus line if it 
separated from the aircraft at the point of initial break-up, and that is where it was found 
(site 3). 


All parts from the fuselage part in front of STA888/909 that were recovered, were found 
in the sites 1, 2 and 3, at or very close to the locus line. 


Thus, it can be concluded that all the pieces of wreckage from the fuselage part in front 
ot STA888/909, recovered from the sites 1, 2 and 3, separated from the aeroplane in the 
first few seconds after the impact of the high-energy objects. 


All aeroplane parts of the fuselage aft of STA888/909, wings and empennage were found 
in sites 4, 5 and 6. These sites are located relatively far beyond the locus line. From this it 
can be concluded that these parts separated from the aeroplane much later than those 
of the forward fuselage. 


3.11.8 Break-up of the aeroplane 

After the impact of the high-energy objects the aeroplane broke up in the air: There are 
two distinct phases in relation to the in flight break-up; the break-up of the front fuselage 
and the centre/rear fuselage. These are described in the paragraphs below. 


3.11.8.1. Break-up of the front fuselage 
The front tuselage broke into the following three main components: 


e the damaged cockpit with a large part of the lower fuselage with the passenger floor 
in front of STA655; 

e large parts of the fuselage above the passenger floor, in front of STA655; 

e the cylindrical fuselage part between STA655 and STA888/909. 


Within approximately one second the fuselage top parts in front of STA655, above the 
passenger floor, were bent upward, while the fuselage lower part in front of STA655, was 
bent downward. This was followed immediately by the fuselage part behind it, bending 
radially outward and separating behind the doors 2L and 2R at (STA 888/909). 


All recovered parts from the fuselage in front of STA888/909, were found on or very 
close to the locus line. This indicates that the break-up sequence of the forward part of 
the aeroplane took place immediately after the last FDR recording, and lasted in the 
order of seconds. 


3.11.8.2 Break-up of the centre and rear fuselage 

The separation of the forward fuselage resulted in significant changes to the mass and 
balance and aerodynamic characteristics or the aeroplane, substantially modifying its 
flight characteristics. 


The centre of gravity moved aft, probably behind its rear certified limit, probably causing 
longitudinal instability of the aeroplane. Further, the aerodynamic loads that would 
normally result from the air impacting and flowing over the smooth forward fuselage 
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were replaced by the loads created by air impacting and flowing over the blunt open, 
damaged fuselage, which resulted in increased drag and altered airflow over the inboard 
sections of the wings. 


Despite having no radar data available for trajectory analysis, a general sequential outline 
of the break-up sequence can be established using wreckage location information in 
combination with the analysis of fractures between the structural parts. As mentioned 
before, as no post-crash radar fixes or eye-witness declarations were available, it is not 
possible to make an accurate reconstruction of the break-up sequence. 


The fact that no wreckage pieces from behind STA909 were found in site 1 through 3 
suggests that after the front part of the aeroplane broke up and separated, the remainder 
of the aeroplane continued flight for some time along an undetermined path. 


In a relative short time interval, the two wing tips, the stabilizers, the fuselage behind 
STA 1546.5, inclusive of most parts of the rear pressure bulkhead, separated from the 
centre fuselage and hit the ground in site 4. The centre fuselage section with the 
remainder of the wings and engines continued their flight for some time as they were 
located in site 6. Later in time, the fuselage part aft of STA 1546.5 broke near the rear 
pressure bulkhead. The main parts behind it, the vertical fin, the centre stabilizer torsion 
box and the damaged tail cone landed very close together at site 5. 


In site 4 several textile rolls were identified on satellite imagery and were, later on, 
recovered from the site. From the cargo manifest it was established that 10 textile rolls 
were transported in a container in the aft cargo compartment located at position 33L. 
The textile rolls were found in close proximity of (500 metres) or on top of other wreckage 
pieces. The textile rolls possessed a very low ballistic coefficient. 


The parts found in sites 4 had big differences in Ballistic Coefficients and they were found 
in close proximity. This suggests the break-up in this site was at a much lower altitude 
and thus later in the break-up sequence than the first break-up. 


This is furthermore substantiated by the wreckage area footprint and spread of the 
wreckage pieces in sites 4 through 6. For sites 4 through 6 the maximum range the 
wreckage pieces are spread is approximately 1.5 kilometres from the main impact point 
in site 6; this is substantially less than the wreckage spread of 7 kilometres for sites 1 
through 3. In site 4 the left and right wing tip were located but the remainder of the left 
and right wings were found in site 6. 


Also the left and right horizontal stabilizers were found in site 4. The left stabilizer was 
found on the right hand side of the expected flight track, the right stabilizer on its left 
side. This suggests that at this point the aeroplane may have been inverted. The stabilizer 
centre torsion box was found in site 5. This suggests that the stabilizers separated at the 
same moment as other parts found in site 4, while the aft tail section continued its flight 
for a short time. 
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In site 5 the vertical fin was located and in close proximity parts of the tail section. The 
crew bunk container, located in the aeroplane aft cargo compartment (hold 31 and 32), 
was located in site 5. 


Other cargo items from load positions 41 to 44 (See Appendix E) were found spread over 
sites 4 and 5. These items were found in reverse, meaning that the items that originate 
from the left hand side of the aeroplane were found predominantly on the right hand 
side of the expected flight track and vice versa. This combined with other wreckage 
pieces suggest that at this point the aeroplane may have been inverted. 


In site 6 a fuselage part just in front of passenger door 3R was found under the aeroplane 
keel beam structure together with a part of the lower fuselage, normally located just in 
front of the centre wing. This suggests that the centre fuselage with the remainder of the 
wings and engines was in an upside down position by a rotation around the lateral axis, 
and thus moving in a rearward direction, during impact with the ground. Both wings 
were found separated from the mid centre section, up-side down in site 6. The engines 
did not separate in the air as both engines were found in site 6 in close proximity of their 
respective wing positions. However, the left engine intake ring was found in site 2. This 
indicates an earlier separation in time of that part. 


With the available information the conclusion can be drawn that after separation of the 
front fuselage, the centre and aft fuselage sections with the complete wings continued 
flying, and then after a short time interval the wing tips broke off and the aft fuselage 
section and tail separated. Thereafter the aft fuselage section may have rolled inverted 
when the stabilizers separated, and later the damaged tail section, with the vertical fin 
and the stabilizer centre torsion box, separated near STA2150. These parts landed closely 
together. From the wreckage pattern it can be seen that this would have been at a low 
altitude. The centre fuselage finally landed in an inverted position after a rotation around 
its lateral axis. 


The time interval between the separation of the front fuselage and the moment that the 
remainder of the aeroplane impacted the ground is estimated to have been 1-1.5 minutes. 
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Findings 


e From the ballistic trajectory analysis it can be concluded that all the pieces of 
wreckage from the fuselage parts in front of STA888/909 departed the aeroplane 
immediately after the last Flight Data Recorder recording. 

e It also indicated that all debris recovered from the other three sites (4, 5 and 6), 
departed the aeroplane later, as their location in the debris tield was relatively far 
beyond the locus line. 

e After separation of the front fuselage, the remainder of the fuselage with the 
complete wings continued its flight. 

e After a short time interval the wing tips broke off and the aft fuselage section 
with the tail separated. 

e Thereafter the aft fuselage section may have rolled inverted when the horizontal 
stabilizers separated, and later the damaged tail section, with the vertical 
stabilizer and the stabilizer centre torsion box, separated near STA 2150. 

e The centre fuselage finally landed in an inverted position after a rotation around 
its lateral axis. 

e The time interval between the separation of the front tuselage and the moment 
that the remainder of the aeroplane impacted the ground is estimated to have 
been 1-1.5 minutes. 


3.12 Passenger oxygen system 


The cabin pressure altitude recorded on the Flight Data Recorder, described in Paragraph 
2.18.2, was 4,800 feet during cruise up to the moment that the recording stopped at 
13.20:03 (15.20:03 CET). The recording stopped due to electrical power interruption as 
analysed in Paragraph 3.4.3. Therefore, the passenger oxygen system was probably not 
activated prior to this moment. 


The perforation of the aeroplane’s structure caused the cabin of the aeroplane to 
depressurise and a cabin altitude of 13,500 feet was exceeded. Had electrical power 
been available, the passenger oxygen masks would have been automatically deployed. 
According to the aeroplane manufacturer, when depressurisation occurs the deployment 
of the masks may take a few seconds, in part as the electrical signal is delayed to avoid 
false deployment. Therefore, the loss of electrical power prevented the system-activated 
deployment of the passenger emergency oxygen masks. 


On the oxygen generators recovered from sites 4 and 5, some solenoid switches were 
deformed and the latches had separated from all of the recovered containers. It is 
therefore considered likely that oxygen masks dropped out of the passenger service unit 
containers due to torsion or other forces upon these containers. This would then result in 
the unlocking or separation of the latches. This could have been the result of either the 
blast of the warhead explosion, the effects of the in-flight break-up or the impact with 
the ground. 
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It requires a force of only a few Newton’? to remove the firing pin from the oxygen 
generator. Therefore, it is conceivable that the oxygen generators were fired as a result 
of the blast, the dynamic forces during the in-flight break-up or the impact with the 
ground. The oxygen generator which had not been fired, originated from the crew rest 
area. It is considered possible that the rest area, a closed container, may have been 
better protected against the dynamic forces during the in-flight break-up or from the 


impact with the ground. 


Black coloured stripe when 
fired; yellow when not fired. 





Figure 75: One of the recovered passenger oxygen generators. (Source: Dutch Safety Board) 


The flight crew's emergency oxygen supply is a different system to that in the cabin. 
Information on the flight crew system could not contribute to the analysis of the cabin 
pressure or cabin oxygen supply system. 


Findings 


e tis considered unlikely that the passenger oxygen masks were deployed before 
the electrical power supply was interrupted. It is unlikely that the passenger 
oxygen system was activated in the normal way. 

e It is likely that passenger oxygen masks dropped down because the passenger 
service unit container latches opened or separated. This occurred as a result of 
the forces exerted upon these latches due to blast, the dynamic forces during 
the in-flight break-up or the impact with the ground. 


3.13 Recovery and identification of victims flight MH17 


Given the circumstances, the recovery and transporting of the human remains were 
carried out with the greatest possible care. The recovery method adopted during the 
first few days after the crash allowed a substantial number of the victims to be identified 
reasonably quickly. At the time of the report’s production, two of the 298 occupants had 
not been identified. 


20 For reference see Federal Aviation Administration specification TSO-C64. 
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Finding 


296 of the 298 occupants of flight MH17 were identified at the time of the publication 
of the Final Report. 


3.14 Survival aspects 


The investigation revealed that the occupants were confronted with the effects of the 
missile’s impact in different ways. The effects were partly determined by the location in the 
aeroplane where they found themselves when the warhead detonated. The impact of 
missile fragments and the subsequent pressure wave caused the aircraft to break up. This 
impact was only instantly fatal to the occupants of the cockpit. The other occupants were 
almost immediately exposed to factors that had an extreme impact on the body and which 
were not the same for everyone. There was the deatening noise of the impact, abrupt 
deceleration and acceleration, decompression and the corresponding mist formation, 
reduced oxygen level, extreme cold, powerful airflow, the aeroplane’s rapid descent and 
objects flying around.*' As a result, some occupants suffered serious injuries that probably 
caused their death. In others, the exposure led to reduced awareness or unconsciousness 
in a very short space of time. It was not possible to ascertain the time at which the 
occupants died; it was established that the impact on the ground was non-survivable. 


It cannot be ruled out that some occupants remained conscious for some time during the 
one to one and a half minutes for which the crash lasted. The Dutch Safety Board deems 
it likely that the occupants were barely able to comprehend the situation in which they 
found themselves.***°:4°.°77 The Dutch Safety Board does not deem it likely that the 
occupants performed conscious actions after the impact.***’? No indications were found 
that point to any conscious actions. No photographs or (text) messages from occupants 
were found on personal data carriers such as mobile phones that were taken after the 
impact. Such messages and photographs were found after several other aircraft crashes. 
There may have been reflexive actions such as clutching the armrests of the seat. See 
Appendix N for more information. 


21 See Appendix N: Background to Passengers Exposure. 

22 Guyton, A.C., J.E. Hall, Textbook of Medical Physiology, Chapter 60. The Autonomic Nervous System and the 
Adrenal Medulla, 2006. 

23 Baddeley, A. D., G. Hitch, ‘Working memory’, in G.H. Bower (Ed.), The Psychology of Learning and Motivation: 
Advances in Research and Theory, Vol. 8, 1974, 47-89. 

24 Ehlers, A., D.M.Clark, ‘A Cognitive Model of Post-traumatic Stress Disorder,’ Behaviour Research and Therapy, 
38(4), 2000, 319-345. 

25 Roediger, H. L., ‘Implicit memory: Retention without Remembering’, American Psychologist, 45, 1990, 1043-1056. 

26 Dalgleish, T., ‘Cognitive Approaches to Post-traumatic Stress Disorder: The Evolution of Multirepresentational 
Theorizing,’ Psychological Bulletin, 130(2), 2004, 228-60. 

27 Qin,S., E.l., Hermans, H.I.F Van Marle, |. Luo, G. Fernandez, ‘Acute Psychological Stress Reduces Working Memory- 
related Activity in the Dorsolateral Prefrontal Cortex’, Biological Psychiatry, July 1;66(1), 2009, 25-32. 

28 A retrospective study by Leach (2004), based on official research reports and written testimonies from various 
maritime and aviation disasters, reveals that freezing is a common response among people in serious emergency 
situations. 

29 Leach, J., ‘Why People ‘Freeze’ in an Emergency: Temporal and Cognitive Constraints on Survival Responses’, 
Aviation, Space, and Environmental Medicine, 2004. 539-542. 
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During the process to identify the victims, one passenger was found with an oxygen 
mask around the neck. It is unclear how the mask got there. The traces the NFI found 
during the forensic examination were not suitable for constructing a DNA profile, thus it 
remains unclear whether the person concerned put on the mask in a reflex or that it was 
done by someone on the ground after the passenger's death. 


Findings 


e The numerous injuries resulting from perforation of the pre-formed fragments 
after detonation of the warhead immediately killed the three crew members in 
the cockpit. 

e There were no pre-formed fragments found in the bodies of the other occupants. 
As a result of the impact, they were exposed to extreme and many different, 
interacting factors: abrupt deceleration and acceleration, decompression and 
associated mist formation, decrease in oxygen level, extreme cold, strong airflow, 
the aeroplane’s very rapid descent and objects flying around. 

e Asa result, some occupants suffered serious injuries that were probably fatal. In 
others, the exposure led to reduced awareness or unconsiousness within a very 
short time. It was not possible to ascertain at which moment the occupants died. 
The impact on the ground was not survivable. 

e The Dutch Safety Board did not find any indications of conscious actions 
performed by the occupants after the missile’s detonation. It is likely that the 
occupants were barely able to comprehend the situation in which they found 
themselves. 


3.15 Recording of radar data 


During the investigation, the Russian Federation declared that the requirement to store 
surveillance radar data only relates to Russian Federation territory. As flight MH17 crashed 
outside this territory, according to the Russian Federation, there was no requirement to 
retain data of flight MH17. However, the ICAO requirements in paragraph 6.4.1 of Annex 
11 make no distinction about the geographic limitation regarding the storage of data 
and they imply that all data shall be recorded. This means that there was a requirement 
to store all radar data, both raw and processed data, regardless of state bounderies. 


The extract of the Russian Federation's national requirements supplied to the investigation 
does not mention a distinction about the geographic limitation regarding the storage of 
data. The automatic recording of radar data by the Russian Federation differs from the 
ICAO standard. When a State cannot, or will not, follow the provisions of an ICAO 
standard, ICAO requires that the difference between the national version of a specific 
standard and ICAO's text be reported to ICAO. The obligation to make such a notification 
arises trom Article 38 of the Convention on International Civil Aviation. 


Based on the information available, it cannot be concluded that a difference exists 
between the Russian Federation's requirements and the ICAO standard in this matter. 
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it was required to provide according to the requirements of paragraph 6.4.1 of Annex 11. met 
Uanleat- lay 
Findings 


e According to the Russian Federation, its requirements for automatic recording 


However, the Russian Federation did not provide the radar data to the investigation that 


and retention of radar data only relate to Russian Federation territory. The extract 
of the requirements provided by the Russian Federation did not mention a 
distinction about geographic limitations regarding the storage of data. aa 

e The ICAO standard in paragraph 6.4.1 of Annex 11 makes no distinction about seria 
the geographic limitation regarding the storage of data; all radar data shall be 
recorded. 

e The Russian Federation did not comply in all respects with the ICAO standard 
contained in paragraph 6.4.1 of Annex 11. 
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PART B: Flying 
over conflict zones 


This part of the report focuses on the 
investigation into the flight route of flight MH17 
on 17 July 2014 and the decision-making related 


to flying over conflict zones. 
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The key questions are: ae 
yaar -Loa tT) 
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This Part of the report deals with the flight route of flight MH17 on 17 July 2014 and the 
decision-making process about flight routes above conflict areas. 


e How and why were decisions made to use MH17’s flight route? 

e How is the decision-making process related to flying over conflict zones generally 
organised? 

e What lessons can be learned from the investigation to improve flight safety and 


Part B: 
security? 


Introduction to 
Part B 


Part B consists of six Sections: 


e Adescription of the system of responsibilities of parties involved; 

e Indicators related to the situation in the eastern part of Ukraine in the months prior to 
the crash of flight MH17; 

e The airsoace management by Ukraine in the period up to and including 17 July 2014; 

e The route and flight operations of flight MH17, the decisions made by the airline, 
Malaysia Airlines, and the decisions made by other airlines and other states with 
regard to flying over the conflict area in the eastern part of Ukraine; 

e The role of the Netherlands, as the state of departure of flight MH17, with regard to 


Part B: 
5 The situation 


flying over conflict areas; aa 
7 Flying over 
e Risk assessment related to flying over conflict zones. thar 


Part B relates to part A in the following manner: 


e In Section 2.1 (part A), flight MH17 is introduced: the flight plan and the actual conduct 
of the flight. In Section 7.2 (Part B), this is further elaborated. ee 

e In Section 2.9 (part A), Air Traffic Management is introduced. In Section 6 of part B, a CRG 
this is further elaborated. risks 


After the crash of flight MH17, various actions were taken to make flying over conflict 
areas safer. Appendix P provides an overview. Where relevant, these are also mentioned 
in the report itself. 
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4.1 Introduction 


This Section describes the tasks and responsibilities of the parties involved in the safety °° 
of civil aviation airspace. A detailed overview of the regulations relevant to this part of 
the investigation and of the parties involved is included in Appendix Q. The second part 
of this Section is devoted to the frame of reference adopted by the Dutch Safety Board 
for this part of the investigation. The Dutch Safety Board analysed the investigation’s 
findings on the basis of regulations as well as on its own frame of reference. 


4.2 States’ and operators’ responsibilities ©’ 


Figure 76 illustrates schematically how the responsibilities related to the use of existing 
flight routes are organised. The parties concerned are: 


1. The state that manages the airspace; 


2. Airline operators; 
3. States in which those operators are based. 


Sovereign state 


Airspace restricted: Airspace open: 
no flying flying permitted 


State of operator Operator: 
prohibits: no flying TUT a dalla bts] -val 


No flying Flying 





Figure 76: Responsibilities in the decision-making process related to airspace usage. (Source: Dutch Safety Board) 





30 Safety is meant here in the broad sense of the word and entails both safety and security. See also Abbreviations 
and Definitions. 
31 Responsibilities arising from provisions in the Convention on International Civil Aviation. 
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4.2.1 States’ responsibilities 


4.2.1.1 The state that manages the airspace 

Each state has sovereignty over the airspace over its territory. This means that the 
relevant state exercises complete and exclusive control over its own airspace.** States 
enter into mutual agreements to open their airspace to operators trom other states.°° For 
reasons of safety, a state may impose limitations on the use of its airsoace and determine 
along which routes and at which minimum altitude aircraft may fly within that airspace. 
The managing state can also partly or fully close its airspace if this is necessary for safety 
reasons.°** Due to its sovereignty, however, a state cannot be compelled to do so. 


In the State Safety Programme (SSP), the state describes how policy, regulations, 
permitting processes and monitoring are organised.*? A state should ensure a safety 
level of the airspace that it has chosen. Although it is not explicitly established anywhere 
that the manager of the airspace must guarantee the safety of the relevant airspace, 
ICAO documents reveal that this is expected of states. The introduction to Doc 9554- 
AN/932°° stipulates that ‘The common use by civil and military aviation of airspace and of 
certain facilities and services shall be arranged so as to ensure the safety, regularity and 
efficiency of international civil aviation’. From this one can deduce that the state must 
make all reasonable attempts to ensure the safety of the airspace, specifically in case of 
common use by civil and military aviation. Circular 330 AN/189, which offers guidance on 
the joint use of airspace by civil and military aircraft, also states: ‘Obligations of ICAO 
Member States under the Chicago Convention germane to civil/military issues include: 


a. Rule-making as regards aviation safety rules in compliance with ICAO SARPs contained 
in the Annexes to the Convention (Article 37); 

b. Carrying out tasks which pertain to, for instance, ATM and which are laid down in the 
Annexes to the Convention, such as the classification of airspace and coordination 
between civil and military air traffic.’ 


Moreover, paragraph 10.3 of Doc 9554-AN/932 states that the state responsible for air 
tratfic services should, on the basis of available information, determine the geographical 
conflict area and assess the dangers or possible dangers to civil aviation. Based on the 
assessment, the state should decide whether the operation of civil aircraft should be 
avoided in or through the conflict area or could be allowed to continue under certain 
conditions. In the latter case, the state should publish an international NOTAM with the 
necessary information, recommendation and safety measures to be taken and update 
this on the basis of any develooments.°’ 





32 Convention on International Civil Aviation, |CAO Doc 7300/9, Paragraph 1. 

33 Airlines from other states need an overflight permit (Convention on International Civil Aviation, CAO Doc 7300/9, 
Article 6). The permit specifies that the airline pays an overflight charge to the state managing the airspace. The 
costs are worked out in an agreement that arises from article 6. 

34 Convention on International Civil Aviation, ICAO Doc 7300/9, Article 9. This includes the activities a state shall 
undertake to ensure an acceptable safety level. Here it involves activities related to Annexes 1, 6, 8, 11, 13, 14 and 19. 

35 Convention on International Civil Aviation Annex 19, Paragraph 3.1.1. 

36 Doc 9554 has a recommending function and is not binding. 

37 ICAO is currently updating Doc 9554. It should be completed in 2015. 
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Although the Chicago Convention exclusively pertains to civil aviation, it does state the 
importance of military aviation and the necessary coordination.** Authorities relevant to 
the provision of air navigation services should work closely with military authorities, who 
are responsible for activities that could influence civil aviation. Civil and military air traffic 
service providers should make coordination agreements for the immediate exchange of 
information relevant to a safe flight operation. This coordination aims to reduce the 
threats resulting to civil aviation as a result of military activities as much as possible.*’ 


States use NOTAMs to publish information concerning the establishment, condition or 
change in any aeronautical facility, service, procedure or hazard, the timely knowledge of 
which is essential to personnel concerned with flight operations’.*° States publish this 
information in addition to or as a supplement to the Aeronautical Information Publication 
(AIP*'). The provision of this aeronautical information aims to make the necessary 
information available to everyone involved in flight operations and air navigation 
services.’* Many states, including Ukraine, have allocated this task to the air navigation 
service provider. 


4.2.1.2 State of operator*® 

The aviation authorities of some states have the legal power to prohibit operators, other 
aviation companies and pilots to whom they have issued a permit or certificate, trom 
flying in the airspace of another country, or to impose a restriction on a foreign airspace. ** 
States can also advise or inform its ‘own’ operators about potential risks. This role of 
states will be addressed further in Sections 7, 8 en 9. 


4.2.1.3 Other relevant state responsibilities 

The responsibilities cited above relate mainly to airspace management. In addition, 
Annex 17 of the Chicago Convention contains Standards and Recommended Practices 
for aviation security. The state shall have as its primary objective the safety of passengers, 
crew, ground personnel and the general public in all matters related to safeguarding 
against unlawful interference in civil aviation.*° ICAO sees the destruction of an aircraft in 
service as an example of unlawful interference.*®° Where necessary, states shall take 
action to maintain aviation security at the desired level.” If they possess threat-related 
information, authorities shall, insotar as is possible and relevant, share it with other 
states.*° 





38 Convention on International Civil Aviation, [CAO Doc 7300, Article 3 (d). 

39 Convention on International Civil Aviation Annex 11, Paragraph 2.18. 

40 Convention on International Civil Aviation Annex 15, Aeronautical Services, Chapter 2. 

41 An AIP is a publication issued by a state’s aviation authority. It contains aeronautical information of a lasting 
character that is essential for air navigation. It contains details related to legislation, procedures and other 
information that is relevant to aircraft flying in the state concerned. AIPs contain more permanent information, 
whereas NOTAMs pertain to short-term or temporary situations. 

42 ICAO Annex 15, Paragraph 3.1.6. There is also the Aeronautical Information Circular (AIC). See Appendix QO, which 
explains all these forms of information provision. 

43 Airlines are based in states. Aircraft are included in an aviation register. The state in which the aircraft is registered 
is responsible for supervising its airworthiness. 

44 This applies, for example, to the US and the UK. These states have national regulations that makes this possible. 
The ICAO framework provides room for this, but does not impose any obligation on states to assume their 
responsibility for the safety of their own nationals respectively the operators established in these states. 

45 ICAO Annex 17, Paragraph 2.1.1. 

46 ICAO Annex 17, Chapter 1, definition of ‘acts of unlawful interference’. 

47 ICAO Annex 17, Paragraph 3.1.3. 

48 ICAO Annex 17, Paragraph 2.4.3. 
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ICAO Member States shall use a national aviation security programme for aviation 
security. In accordance with Annex 17, such a programme exclusively applies to the 
security of the state’s own aviation infrastructure. 


Risks related to the use of foreign airspace are not specifically addressed in Annex 17. 
This does not, however, preclude states from conducting risk assessments of foreign 
airspace, as appropriate. 


A state can request its operators to take additional security measures when operating 
specific flights in the airspace of other states.*” The state shall also possess systems for 
monitoring requirements related to aviation security.”° 


4.2.2 Operators’ responsibilities 

Operators determine which flight routes they use in the available airsoace and perform 
their own assessments when opting for a particular flight route. These may be 
considerations of aviation safety, but also concern the aeroplane and costs. The 
responsibility for sate flight operations is also cited in Annex 6 of the Chicago 
Convention.’' In accordance with the aforementioned Annex 17 of the Chicago 
Convention, states shall require its commercial air transport operators to have in place a 
written operator security programme that satisfies the requirements of the National Civil 
Aviation Security Programme of the state concerned.°* Combined with the provisions in 
Annex 19, they are required to have and use a safety management system as well as a 
security programme.’ Annex 17 includes provisions for operators mainly related to the 
security at aerodromes or in the aeroplane. The security of flight routes in foreign 
airspace is not part of the provisions in Annex 17. 


If a particular foreign airspace is not closed or restricted, and the state in which an 
operator is based has not issued an overflight prohibition or restriction that applies to 
this particular airspace, it is the operator that decides whether to use that airspace or 
not. This means that operators have a responsibility to determine whether a flight route 
is sate enough to be used. Operators can use various information sources, such as public 
sources, sources from the government of the state in which they are based, external 
consultants, other operators and its own personnel. The latter also includes staff 
specifically charged with security aspects. 


The aircraft captain is responsible for ensuring that flights are operated in accordance 
with aviation regulations as included in ICAO Annex 2.°* This also covers flight 
preparation.’’ ICAO does not specifically mention the assessment of safety and security 
aspects related to airspace and flight route. ICAO anticipates a role for the operator as 





49 ICAO Annex 17, Paragraph 2.4.1. 

50 ICAO Annex 17, Paragraph 3.4 - Quality Control. 

51. Convention on International Civil Aviation Annex 6, part |, Aeroplanes, Paragraph 4.1. 

52 Annex 17 of the Chicago Convention affords states room for a broad interpretation in which risks to foreign flight 
paths are also part of the National Security Plan, but the elaboration in the ‘Aviation Security Manual’ illustrates 
that such a broad interpretation is uncommon. 

53. ICAO Annex 19, Safety Management, Paras 3.1.3 and 4.1 and ICAO Annex 17, Paragraph 3.3.1. 

54 Convention on International Civil Aviation Annex 2, Rules of the Air, Paragraph 2.3.1. 

55 Convention on International Civil Aviation Annex 2, Paragraph 2.3.2. 
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well as the captain if there is a sudden outbreak of armed violence.*® On this matter 
ICAO states that, once the usual coordination processes between civil and military 
authorities are no longer followed due to a sudden outbreak of violence, the operators 
and the captain must assess the situation, using the information available to them, and 
take action so as not to jeopardise safety.°” 


4.2.2.1 Code sharing”® 

Many operators use code sharing as a marketing tool and generate additional revenues 
that way. It involves two or more operators offering seats under their own names on a 
single flight operated by one of these operators. This makes it possible, for example, for 
an operator to offer destinations to which it does not fly itself. The operator with which 
the tickets are booked is obliged to inform passengers about the operator that will 
actually be operating the flight concerned. 


Flight MH17 used code sharing: KLM sold seats on flight MH17 under its own name. 
When code sharing, the operator that actually operates the flight bears responsibility for 
passenger safety during the flight. 


There are no binding ICAO requirements related to code sharing. ICAO Annex 17 does 
however recommend that a state requires its operators to inform the appropriate 
authority about their code sharing arrangements to the aviation security in the state 
where it is based. ICAO stipulates that when authorising a code share agreement, the 
state shall consider public interests and shall assess whether operators satisfy relevant 
international safety standards.*’ ICAO does not specify which interests and standards are 
relevant. 


4.3 Frame of reference 


In its investigation the Dutch Safety Board uses a frame of reference. This consists, on 
the one hand, of the applicable laws and regulations and, on the other hand, on the 
Dutch Safety Boara’s view on management of safety risks that is as effective as practically 
possible. 


Flying is an important mode of transport and a vital part of contemporary society. 
Passengers ought to be aware that flying involves risks. The chance of a crash in aviation 
is small, but the consequences of such a crash can be significant. 


It is very difficult for passengers to independently gather sufficient information about the 
risks of flight routes. Therefore they cannot - or virtually cannot - assess independently 
whether a route is sufficiently sate, also because flight routes can change right up to the 
last moment and even during a flight. 


56 In ICAO Doc 9554, the Manual Concerning Safety Measures Relating to Military Activities Potentially Hazardous to 
Civil Aircraft Operations. 

57. ICAO Doc 9554, Paragraph 3.1.1. Also refer to Appendix QO. 

58 Code sharing is explained in more detail in Appendix O. 

59 ICAO Doc 8335, Part V, Chapter 4, Paragraph 4.1.2. 
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With this in mina, all aviation parties bear a major responsibility with regard to safety. 
The Dutch Safety Board expects private and public parties in the system to manage 
safety (including new risks) as effectively as possible and using the latest technology, 
both individually as well as collectively. The nature of this responsibility of the parties 
concerned can be compared to that of a duty of care. This means that the parties are 
expected to make optimal efforts with regard to civil aviation satety and not exclusively 
stick to their strict task description. 


The Dutch Safety Board expects states and operators to - at least - comply with legislation 
and regulations. With regard to Sections 6 and 7, dealing with the responsibilities of 
Ukraine and Malaysia Airlines, the legal frameworks as discussed in Appendix O represent 
a major component of the frame of reference for the investigation conducted by the 
Dutch Safety Board. Since the investigation also examines the extent to which the legal 
frameworks and their implementation leave room for improvement, the Dutch Safety 
Board also adopts its own frame of reference in addition to the legal frameworks. 


The general principles of the frame of reference adopted by the Dutch Safety Board 
arise from insights from safety science and involve risk inventory and risk assessment and 
coping with uncertainty. 


4.3.1 Risk inventory and risk assessment 

The Dutch Safety Board expects all parties involved - states, operators and international 
organisations such as ICAO and EASA - in the spirit of the Chicago Convention, and with 
regard to the principles behind ICAO to proactively identify risks and, if necessary, adapt 
their safety approach to limit these risks as much as can reasonably be expected. This 
means that all the organisations involved shall always take the measures available to 
reduce and/or manage the risk, unless these involve demonstrably disproportionately 
high costs or other negative consequences. This general principle arises from the 
so-called ‘ALARP’®° principle, which requires parties involved to consciously and 
transparently weigh risks against the effort, time and investments needed to reduce and/ 
or manage that risk. This principle originated in the field of external safety and means 
that parties that cause risks shall take measures in the context of their social duty of care, 
unless they can demonstrate that these measures are disproportionate. 


4.3.2 Coping with uncertainty 

The Dutch Safety Board expects uncertainty to be the basic point of departure of the 
approach adopted by the parties. This means that the parties concerned shall remain 
constantly alert and receptive to signals that could indicate the inaccuracy or 
incompleteness of earlier assumptions. This requires them to be constantly vigilant with 
regard to risks and be prepared to question common assumptions. 





60  ALARP: As Low As Reasonably Practicable. 
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5.1 Introduction 


This Section describes information that the Dutch Safety Board found in public and 
closed sources, pertaining to the situation in the eastern part of Ukraine during the 
period between 1 March and 17 July 2014. Were there events and developments prior to 
the crash of flight MH17 that states or operators could have interpreted as signals of a 
possible decrease in the safety of the airspace above the area and thus of an increasing 
risk to aircraft flying over it? °' 


The public sources examined are both primary sources (official information from the 
Ukrainian State, NOTAMs, ICAO State Letters and EASA safety information bulletins) and 
secondary sources, such as newspaper reports, audiovisual media and social media 
related for example to security incidents and the possible presence of weapons in the 
area.°* The focus is on primary information, because it is more difficult to verify the 
accuracy of information in news media. 


The non-public sources originated from the Dutch intelligence services and the Kingdom 
of the Netherlands diplomatic mission in Ukraine. A large part of this information is 
indirect, which means it originates from closed briefings at which (mainly Western) 
diplomats, including defence attachés, shared information about political and military 
developments in and around the conflict area. It can therefore be assumed that most of 
the information that was available to the Dutch services was also available - or could be 
available - to the representatives of other Western states. The Dutch Safety Board did 
not have access to non-public sources from non-Western states and therefore cannot 
make any statements about what information those other states possessed. 


5.2 Aeronautical information’ 


The Dutch Safety Board examined the extent of the availability of aeronautical information 
that could have signalled increasing deterioration of the safety of the airspace above the 
eastern part of Ukraine. 


In March 2014, the Russian Federation issued NOTAMS for the Simferopol FIR (Crimea), in 
which a Russian air traffic service was introduced for the Crimea. Ukraine responded to 





61 The information included in this Section is partly based on a study performed by the The Hague Centre for 
Strategic Studies (HCSS) at the request of the Dutch Safety Board. 

62 Amore detailed description of HCSS’s working method, also with regard to media (including social media), is 
included in the report MH17 - About the investigation. 

63 Whenever the Dutch Safety Board mentions NOTAMs, this refers to a selection of NOTAMs that were deemed 
relevant. All ‘active’ NOTAMs are included in Appendix D. 
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this by issuing a NOTAM in which the message from the Russian Federation was rejected 
and in which was indicated that Ukraine continued to be responsible for providing air 
traffic services in this airspace. 


This was followed by more NOTAMs from Ukraine as well as from the Russian Federation.°* 
The situation thus created led to the possibility that civil aviation over the area would 
receive conflicting instructions, as the various NOTAMs made it clear that there were two 
air navigation service providers that both claimed responsibility for air tratfic management. 
This could present a risk to the safety of air traffic due to possible conflicting instructions. 
On 2 April 2014, ICAO published a State Letter in which Member States were informed 
of the potential risks to the safety of civil flights in the Simferopol FIR, as a result of the 
conflicting instructions: ‘Due to the unsafe situation where more than one ATS provider 
may be controlling flights within the same airspace from 3 April 2014, 0600 UTC onwards, 
consideration should be given to measures to avoid the airspace and circumnavigate the 
Simferopol FIR with alternative routings.’ °° 


Also on 2 April, and in response to the ICAO State Letter, the Network Manager at 
EUROCONTROL urgently recommended that operators avoid Crimean airspace (the 
Simferopol FIR) and select alternative routes.°° On 3 April 2014, EASA issued a Safety 
Information Bulletin (SIB), in which EASA highlighted ICAO’s warning.°” 


In the State Letter of 2 April 2014 regarding Simferopol FIR, ICAO also announced that it 
would continue to remain active in coordinating all parties regarding any dangers for civil 
aviation: ‘ICAO continues to actively coordinate with all involved authorities, international 
organisations, airspace users and other states in the region regarding developments as 
they unfold, specifically those which could impact flight safety.’ However, during the 
period of 2 April through 17 July 2014, the period during which the armed conflict in the 
eastern part of Ukraine broke out and intensified, ICAO did not mention the situation in 
Ukraine again. 


The U.S. Federal Aviation Administration (FAA) published FDC NOTAM 4/3635 on 
4 March 2014. In this NOTAM, the FAA warned U.S. operators and airmen that were 
flying to, trom or over Ukraine to be careful in connection with potential instability. From 
this information it appeared that there were increasing military activities in Ukraine 
airspace and in the area of military aerodromes. Civil aviation could encounter military 
activities, particularly in the Crimea region: ‘Potentially hazardous situation - Flight 
operations into, out of, within, or over the Ukraine U.S. Operators and airmen should 
exercise caution when operating in the Lvov (UKLV), Kyiv (UKBV), Dnepropetrovsk (UKDV), 
Odessa (UKOV) and Simferopol (UKFV) flight information regions (FIRs) due to the 
potential for instability. Information from the European Emergency Coordination Crisis 
Cell and open source media reports indicates there is an increased military presence in 
the airspace over Ukraine and in the vicinity of military aerodromes. Civil flight operations 





64 These are the following NOTAMs: A0528/14, A0520/14, A0524/14 and A0569/14 from Ukraine and NOTAMs 
A0906/14, A0907/14A02, AO907/14B02, A0909/14, AO0910/14, A0911/14A02, A0911/14B02, A0912/14 from the 
Russian Federation. 

65 ICAO State Letter (EUR/NAT 14-0243.TEC (FOL/CUP)), 2 April 2014. 

66 EUROCONTROL Headline News, 2 April 2014. 

67 EASA Safety Information Bulletin 2014-10, 3 April 2014. 
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in the Ukraine, particularly in the Crimean region, may be exposed to military activity. U.S. 
operators and airmen flying into, out of, within or over the Ukraine must review current 
information and NOTAMs, comply with all applicable FAA Regulations and directives and 
exercise extreme caution.’ This NOTAM was valid up until 31 March 2014. 


The U.S. FAA subsequently issued FDC NOTAM 4/2816 on 3 April 2014. This contained a 
flight prohibition imposed on U.S. operators and airmen pertaining to the use of the 
airspace above Crimea, the Black Sea and the Sea of Azov. This NOTAM also contained a 
warning related to all other Ukrainian FIRs: ‘U.S. operators and airmen flying into, out of, 
or within Lvov (UKLV), Kyiv (UKBV), Dneptropetrovsk (UKDV), and Odessa (UKOV) FIRs, as 
well as airspace in the Simferopol (UKFV) FIR that is outside the lateral limits of the 
airspace over the Crimea, the Black Sea, and the Sea of Azov [...] must review current 
security/threat information and NOTAMs; comply with all applicable FAA regulations, 
operations specifications, management specifications, and letters of authorisation, 
including updating B450; and exercise extreme caution due to the continuing potential 
for instability.’ (Emphasis added by the Dutch Safety Board.) 


On 23 April, this was followed by FDC NOTAM 4/7667 (A0012/14), which contained FAA 
SFAR 113 and repeated previous prohibitions and warnings, enacting them.°*°’ The 
warning pertaining to the remainder of Ukraine was formulated in general terms and did 
not contain any specific information about the armed conflict and the potential risks it 
could present to civil aviation. Therefore, prior to the crash of MH17, no state or 
international organisation other than Ukraine issued a specific safety warning about the 
eastern part of Ukraine. 


The list of all the relevant NOTAMs published by the Ukrainian authorities makes it clear 
that, from mid-March 2014, parts of eastern Ukrainian airspace were regularly closed or 
their use was restricted for brief periods of time. The duration of the restrictions varied 
from several hours to several days. Restrictions involved, for example, certain training 
and exercise areas being activated and thus being closed to civil aviation; use by civil 
aviation only being possible with permit, and certain parts of flight routes being closed 
up to a particular altitude. The reasons for these restrictions or temporary closures were 
not cited. Due to the fact that so-called ‘State aircraft’ were excluded and that exercise 
areas are intended for military aircraft, it can be deduced that airspace restrictions were 
related to Ukrainian air force activities. From June up to 18 July 2014, an increase can be 
observed in the number of published NOTAMs in which the use of parts of the airspace 
and air routes over the eastern part of Ukraine was restricted. 


On 17 July 2014, the day of the crash of flight MH17, 28 NOTAMs were in force pertaining 
to the airspace in the eastern part of Ukraine. Eight of those NOTAMSs referred to airspace 
restrictions. A number of NOTAMs that specified a restriction pertained to the airspace 
at low altitudes, below 5,000 feet. On 5 June 2014, the Ukrainian authorities published 
NOTAM A1255/14 (for the airways) and A1256/14 (for the area) with which they temporarily 





68 For an explanation of ‘SFAR’, see Section 12, Abbreviations and Definitions. 
69 By assigning the NOTAM SFAR status, this NOTAM immediately entered into effect with a legislative status. The 
FAA has this option to prevent potential danger to persons and/or aeroplanes. 
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restricted the airspace above the eastern part of Ukraine below FL260”° for civil aviation. 
These NOTAMsS were valid from 6 June until 30 June 2014. On 26 June, the Ukrainian 
authorities published NOTAM A1383/14 (for the area) and A1384/14 (for the airways) with 
which they prolonged the temporary restrictions. These NOTAMs were valid from 1 until 
28 July 2014. On 14 July 2014, the Ukrainian authorities increased the airspace restriction 
to FL320. The relevant NOTAMs”' were valid from 14 July until 14 August 2014. The 
reason for the airspace restrictions was not specified in the NOTAMs (also refer to 
Section 6). 


On 16 July 2014, the Russian Federation authorities published two NOTAMs for the 
Rostov FIR,’* an area that borders the Dnipropetrovsk area in the eastern part of Ukraine. 
These NOTAMs entered into force on 17 July at 00.00. Both NOTAMs refer to the armed 
conflict in the eastern part of Ukraine as the reason for their issue: ‘Due to combat actions 
on the territory of the Ukraine near the state border with the Russian Federation and the 
facts of firing from the territory of the Ukraine towards the territory of the Russian 
Federation, to ensure intl flt safety.’ 


The NOTAMS effectively imposed the same altitude restrictions as the Ukrainian NOTAMs 
(FL320) did. However, at the end of NOTAM UUUUV6158/14 it states that it applies to the 
airsoace from ground level to FL530. In other words, this particular NOTAM mentions 
two different altitudes. The aforementioned FL530 that is specified at the end of the 
NOTAM is much higher than the Ukrainian airspace restriction. 


The aeronautical information from states other than Ukraine in which warnings were 
issued to civil aviation with a reterence to military activities in Ukraine is thus captured in 
the U.S. NOTAM of 4 March mentioned earlier and in the Russian NOTAMs for Rostov of 
16 July. The U.S. NOTAM referred to military air activities but was valid up to 31 March 
and was related to the airspace of all of Ukraine. The Russian NOTAMs were directed at 
the Rostov FIR, i.e. Russian airspace, and not at flying over the eastern part of Ukraine 
and conflicted internally (two altitudes). They referred to military activities in the eastern 
part of Ukraine and the ensueing risks posed by such activities as the reason for the 
airspace restrictions. The Russian Federation authorities stated in answer to Dutch Safety 
Board enquiries that the restricting measures were taken to create agreement with the 
adjoining Ukrainian airspace. The Board did not receive any clarity on the meaning of the 
restriction to FL530. 


Since flight MH17 also flew over the Rostov FIR, the Russian NOTAMs concerned were 
also part of the briefing package for flight MH17. Despite the internal contradictions they 
were accepted by the automated flight plan system. The cited information in the NOTAM 
on the conflict is not automatically obvious from the selection, but it becomes apparent if 
someone studies the NOTAMs package in detail (also refer to Section 7). 


70 Flight level is an altitude expressed in 100s of feet in relation to the surface with a standard air pressure of 1013,25 
hectopascals. FL260 is equal to 26,000 feet and is equivalent to approximately 7,700 metres. See the explanation 
in Section 12, Abbreviations and Definitions. 

71 This was done by means of NOTAMs A1492/14 (for the area) and A1493/14 (for the airways). 

72. NOTAM UUUUV2681/14 and UUUUV6158/14. 
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5.3 Shootings involving military aircraft 


During the period between the conflict breaking out in the eastern part of Ukraine in 
April 2014 and the day of the crash of flight MH17 on 17 July, a number of Ukrainian 
military aircraft were shot at (mostly from the ground). The Ukrainian authorities officially 
confirmed some of these incidents although specific details, such as the weapons used 
or the altitude at which the incident occurred, were not always revealed. 


This Section provides an overview of the incidents that were confirmed by the Ukrainian 
authorities. These are also shown in Figure 77. In those cases in which Ukrainian authorities 
mentioned the flight altitude of a downed aeroplane, this is indicated in the figure. It 
cannot be ruled out that, during the period mentioned, other incidents also occurred. 
Therefore, no verified overview of the total number of incidents can be provided. 


On 22 April 2014, a Ukrainian military aeroplane (Antonov An-30B) was shot at during a 
reconnaissance flight above Slavyansk. On its website, Ukraine’s Ministry of Defence 
declared that the aeroplane had been attacked using automatic weapons, but had been 
able to land safely.’? The shooting of the Antonov An-30B was, as far as known, one of 
the first incidents in the eastern part of Ukraine in which an Ukrainian Air Force aeroplane 
had been hit from the ground and that had been confirmed by the authorities. During 
the weeks following the incident involving the Antonov An-30B, mainly helicopters of the 
Ukrainian Air Force were shot above the conflict area.” Some of these incidents were 
officially confirmed. 





73 Ukraine’s Ministry of Defence website, http://www.mil.gov.ua/news/2014/04/22/nad-slov%E2%80%99yanskom- 
buv-obstrilyanij-litak-povitryanih-sil-zs-ukraini/, consulted on 11 March 2015. 

74 See for example: Ukraine’s Ministry of Internal Affairs, http://mvs.gov.ua/mvs/control/main/uk/publish/ 
article/1065660, consulted on 14 January 2015. 


ie = y 4 181-ot 279 












Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 
7 Flying over 
Ukraine 


Part B: 
9 Assessing the 
aL « 


ai 
Recommendations 


16 
List of appendices 


4-3-2014 

FAA FDC 4/3635 (special notice) 
Ukraine potentially hazardous situation 
UKLV, UKDV, UKOV, UKFL FIRs due to 
instability, increased military presence- 
to be re-evaluated 31-3-2014 


2-4-2014 

UKKR A 0569/14 and 

ICAO State Letter Warning 

ATS misunderstandings; 

avoid Simferopol (Crimea) 
3-4-2014 
EASA SIB 2014-10 and FAA 
FDC 4/2816 
Simferopol FIR prohibited; 
Extreme caution other FIRs 


23-4-2014 

FAA FDC 4/7667 (A0012/14); 

SFAR 113 Simferopol FIR prohibited; 
Extreme caution other FIRs 


6-6-2014 

UKKR A1255/14; 
A1256/14 

FL260 


1-7-2014 
UKKR A1383/14; A1384/14 
FL260 


17-7-2014 
UKKR A1507/14; A1517/14 
Airspace closed Civil air traffic 


After 17-7-2014 
UK CAA B1930/14 UKDV FIR added 


24-7-2014 

ICAO State Letter 

Civil aircraft operating in airspace 
affected by conflict 
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ATS-misunderstandings 
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UKKR A1492/14; 
A1493/14 
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17-7-2014 
18-7-2014 
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Figure 77: Timeline of downed aircraft above the eastern part of Ukraine, period 22 April 2014 - 17 July 2014 
and NOTAMs from 1 March 2014 - 18 July 2014. These involve incidents that were confirmed by the 
Ukrainian authorities. (Source: Dutch Safety Board) 
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In June and July, transport and fighter aeroplanes were downed as well as helicopters. 
On 6 June 2014, a sookesman for the Ukrainian armed forces stated on social media that 
an Antonov An-30B had been downed using a MANPADS at an altitude of less than 
4,500 metres near Slavyansk.” On 14 June 2014, the Ministry of Detence reported that a 
Ukrainian Air Force Ilyushin 76MD military transport aeroplane had been downed during 
landing at Luhansk aerodrome. This was carried out using a MANPADS, followed by 
machine gun fire. There were 49 fatalities.’”° Various media devoted attention to this event 
and the incident also led to international reactions.’’ During the weeks that followed, 
other incidents occurred in which a helicopter (Mil Mi-8TV, 24 June 2014) and fighter 
aeroplanes were shot down. On 1 July an attempt was made to down a Su-25 UB” and 
on 2 July 2014 a Su-24 was shot at.’” Both were allegedly targeted by a MANPADS. 


On 14 July, three days prior to the crash of flight MH17, a Ukrainian Air Force transport 
aeroplane, an Antonov An-26, was downed in the Luhansk region, killing two members 
of the crew. On the same day, Ukraine’s National Security and Defence Council (RNBO) 
published a press release that stated that the aircraft was flying at an altitude of 
6,500 metres when it was hit (see the box for a literal English translation of the text).°° 
Given this altitude, according to the Ukrainian authorities the aircraft must have been hit 
by a ‘more powerful weapon’ than a MANPADS. 


The Ukrainian government assumed two possibilities: a modern anti-aircraft system 
‘Pantsir’®' or an ‘'X-24 Air-to-air missile’.°* The authorities assumed that it was a weapon 
fired from the Russian Federation, because the armed groups would not have such 
weapons.” °** Later, the Ukrainian authorities stated that is was most likely an air-to-air- 
missile. Because the An-26 flew below the altitude of FL230-240, which was regarded as 
sate to military aviation, the authorities did not see the attack as a risk for civil aviation 
that tlew above FL320. 





75. The press secretary of the Ukrainian armed forces announced via social media that it involved an An-26: https:// 
www.facebook.com/vladislav.seleznev.94/posts/451342608335801, consulted 11 March 2015. Aviation Safety 
Network reported that it could not be established with certainty whether an An-30B or An-26 had been involved: 
http://aviation-safety.net/database/record.php?id=20140606-0, consulted 13 January 2015. 

76 http://www. mil.gov.ua/news/2014/06/14/vijskovo-transportnij-litak-povitryanih-sil-zbrojnih-sil-ukraini-il-76/, 
consulted on 13 January 2015. 

77 See for example http://www.telegraph.co.uk/news/worldnews/europe/ukraine/10899657/Ukraine-rebels-shoot- 
down-plane-carrying-49.html, consulted on 12 March 2015; http://www.bbc.com/news/world-europe-27850190, 
consulted on 12 March 2015. 

78 There is no known official, written confirmation of this incident, even though a spokesperson for the Ukrainian 
armed forces is cited as confirming the incident in various media: http://ukr.segodnya.ua/regions/donetsk/ 
terroristy-pytalis-iz-zenitok-sbit-samolet-su-25-spiker-ato-532935.html, consulted on 13 January; http://www.wz. 
lviv.ua/news/69458, consulted on 13 January; http://podrobnosti.ua/podrobnosti/2014/07/01/982855.html. 

79 http://www.rnbo.gov.ua/news/1711.htm!?PrintVersion. 

80 The altitude of the Antonov An-26 is not substantiated with further details in the RNBO press release. 

81 A Pantsir-S1 is a combined system of airborne guns and medium-range surface-to-air missiles with a range of up to 
20 kilometres. (http://www.janes.com/article/48685/russian-tos-1-and-pantsyr-s1-systems-reported-in-east-ukraine, 
consulted 14 August 2015). 

82 This type of air-to-air missile is not known. In response to additional questions by the Dutch Safety Board about 
this incident, the Ukrainian authorities have stated that, when drafting the report, a technical error was made in the 
reference to the type. 

83. http://mediarnbo.org/2014/07/14/zvedena-informatsiya-informatsiyno-analitichnogo-tsentru-rnbou-na-17-00-14- 
lipnya-2014-roku/ and _ http://mediarnbo.org/2014/07/15/znaydeno-chetvero-chleniv-ekipazhu-an-26/, consulted 
on 27 July 2015. 

84 The shoot-down of the An-26 was also confirmed by Klimkin, the Minister of Foreign Affairs, in a closed briefing 
with diplomats at the Presidential Administration of Ukraine. But then a flight altitude of 6,200 metres was 
mentioned. Also see Sections 5 and 8.4 and Appendix T. 
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Statement from the RNBO” Information Analysis Centre of 14 July 2014 at 
17.00°° °’ 


Military operations in the conflict zone 

“Today, all communication with the AN-26 aircraft of the Armed Forces of Ukraine 
was lost at approximately 12:30 hrs. The aircraft ensured air transport during the 
active phase of the anti-terrorist operation. Ukrainian soldiers immediately started a 
search and rescue operation. Crew members were finally reached. During the 
evening briefing, Andriy Lysenko, the spokesperson for the Information Analysis 
Center of the National Security and Defence Council, announced that today the 
Defence Minister reported to the President of Ukraine that fortunately, the crew had 
managed to eject from the damaged aircraft. It turned out that the plane had been 
flying at an altitude of 6,500 meters when it was hit. No portable anti-aircraft missile 
system, which is currently used by the terrorists, can strike an aircraft at such an 
altitude. The AN-24°° was hit by a more powerful weapon that was probably tired 
from the Russian Federation. Based on information transmitted by the Ukrainian 
pilots, two versions are currently being considered: a shot was fired from either the 
Pantsir modern ground-based air defence system or the X-24 guided air-to-air 
missile from a Russian aircraft, which could have taken off from Milyerovo Airport. 


ea 


According to a press release of 15 July 2014, a committee was to investigate the causes 
of the crash and report on the matter. The results of this investigation have not yet been 


published.°*’ 


In answer to additional questions by the Dutch Safety Board, the Ukrainian authorities 
responded that a provisional investigation had revealed that the plane was shot down by 
an air-to-air missile, most likely fired from inside the Russian Federation. A flight altitude 
of 6,300 metres was indicated. When this provisional investigation was completed was 
not specified, but it was mentioned that it took a number of days before it was completed 
because the wreckage of the aeroplane were inaccessible. The results of the provisional 
investigation were not published prior to 17 July 2014. In December 2014, a press release 
appeared in which it was suggested that the aeroplane was hit by an air-to-air missile.”° 
None of the public reports prior to 17 July 2014 made a connection to risks for civil 
aviation. 





85 The RNBO is Ukraine’s National Security and Defence Council, an advisory body to the president. 

86 http://mediarnbo.org/2014/07/14/zvedena-informatsiya-informatsiyno-analitichnogo-tsentru-rnbou-na-17-00-14- 
lipnya-2014-roku/, consulted on 30 March 2015. 

87 All times mentioned in this report are in UTC. 

88 This isa literal translation; the mentioned aeroplane should be An-26. 

89 See: http://mediarnbo.org/2014/07/15/znaydeno-chetvero-chleniv-ekipazhu-an-26/ The press release also stated 
that ‘given the investigation into the crash of the AN-26 [...] in the Luhansk area on 14 July 2014, all Ukrainian air 
force flights will be suspended until further orders.’ This message was also distributed by ATO (the Ukrainian 
armed forces that fight the Separatists) on social media, although it is unclear what this flight restriction and its 
scope involved exactly, see: https://www.facebook.com/ato.news/posts/830779603599514, consulted on 14 
March 2015. After 14 July, two more Ukrainian army Sukhoi aircraft were shot down, although the location and 
altitude at which these incidents occurred cannot be accurately established. 

90 http://www. president.gov.ua/news/31726.html, consulted 31 March 2015. 
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On 17 July 2014, the Ukrainian Ministry of Defence stated that, on 16 July, a Sukhoi Su-25 
fighter aeroplane was shot at in the Donetsk region, near the Ukrainian-Russian border 
(Amvrosiivka). According to Ukraine, it involved an air-to-air missile that had apparently 
been fired by a military aeroplane belonging to the Russian Federation’s armed forces, 
which was conducting border control flights.?’ On 17 July, the Ministry of Defence 
reported that the previous day, another Su-25 had been shot at by a MANPADS, in which 
the pilot of the fighter plane had successfully performed an emergency landing.” 


Op 18 July, the shooting of the Su-25 at Amvrosiivka was also mentioned in a media 
report by the RNBO National Security and Defence Council. It stated that the Su-25 was 
shot down above the Russian Federation at 8,250 metres with a Russian MIG-29 by a 
medium-range air-to-air missile.”* In response to additional questions by the Dutch Safety 
Board about this incident, the Ukrainian authorities stated that a provisional investigation 
had revealed that the plane was flying at an altitude of 6,250 metres. It also stated that 
the possibility of a shooting down with a Pantsir system (also from the Russian Federation) 
was viewed as an alternative (but less likely) cause. When exactly this preliminary 
investigation has been completed has not been stated. 


From the aforementioned it is clear that between April and July, the armed conflict in the 
eastern part of Ukraine was continuing to extend into the air. Ukrainian armed forces 
aeroplanes and helicopters conducted assault flights and transported military personnel 
and equipment to and from the conflict area. The armed groups that were fighting 
against the Ukrainian government attempted to down these aeroplanes. In May 2014, 
mainly helicopters were downed, while in June and July also military aeroplanes were 
downed, including fighter aeroplanes. 


The Ukrainian authorities did not specify the exact altitude at which the attacked aircraft 
were flying for the majority of these incidents. From the official confirmations it is clear, 
however, that in many cases the shootings were carried out with portable short-range 
surface-to-air missiles. In the case of the Antonov An-26 on 14 July and that of the Sukhoi 
Su-25 on 16 July, the Ukrainian authorities also stated the possibility of a medium-range 
surface-to-air missile or an air-to-air missile, possibly fired from inside the Russian 
Federation. In an official statement related to the shooting of the An-26, the Ukrainian 
authorities specified an altitude of 6,500 metres - an altitude that, in their opinion, could 
not be reached using MANPADS. The Dutch Military Intelligence and Security Service 
(MIVD) concluded on the basis of images of the damage and witness statements that the 
aeroplane must have been shot down with a MANPADS. The possibility of an air-to-air 
missile was not mentioned (see Section 8.4). The Russian Federation denied any 
involvement in the incidents. 





91 http://www.mil.gov.ua/news/2014/07/17/rosijskij-vijskovij-litak-zbiv-ukrainskij-su-25-v-nebi-donbasu/, consulted 13 
January 2015. This press release was published on 17 July at 12.18 CET on the website of Ukraine’s Ministry of 
Defence. 

92 http://www.mil.gov.ua/news/2014/07/16/bojovi-litaki-povitryanih-sil-zs-ukraini-v-ramkah-vidnovlennya-bojovih- 
zavdan-nanesli-dekilka-tochkovih-aviaudariv-po-viznachenih-obektah-protivnika/, consulted 13 January 2015. 

93 http://mediarnbo.org/2014/07/18/nsc-news-analysis-center-briefing-at-12-00-july-18-2014/?lang=en, consulted 13 
July 2015. 
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5.4 Public interpretations of the conflict by politicians and diplomats 


In the months prior to 17 July 2014, Western politicians and high-ranking military 
authorities and diplomats publicly expressed their concerns about the situation in the 
eastern part of Ukraine. In this context, they also discussed the Ukrainian military 
aeroplanes and helicopters that had been downed. In doing so, they also made a 
connection to a possible Russian involvement in the conflict. 


On 24 June, the U.S. Permanent Representative to the United Nations, Power, in the UN 
Security Council spoke about the situation in the eastern part of Ukraine. She also 
mentioned the crash of the Ilyushin 76MD military transport aeroplane during its landing 
at Luhansk Airport (14 June). In her opinion the aircraft could have been downed with 
Russian weapons: 


‘We don’t need to look very far or very hard to find evidence of this campaign. We see it 
in the three T-64 Russian tanks which suddenly showed up in the hands of separatists in 
Eastern Ukraine. We see it in the burnt out BM-21 rocket launcher - one of many that 
suddenly appeared in Eastern Ukraine in the past weeks - which photographs shows 
recently belonged to Russia’s 18th Motorized Rifle Brigade, based in Chechnya. We see it 
in surface-to-air missiles that were recently seized by Ukrainian forces after a clash with 
separatists. They were still accompanied by their official paperwork, revealing that - as 
recently as two months ago - these missiles were held on a Russian Air Defence Base in 
the Krasnodar region. These are just the type of surface-to-air missiles, | would note, that 
were used to bring down a Ukrainian military transport plane last week, killing all 
49 people on board. And we see it in the alarming redeployment of thousands of Russian 
troops and military hardware along the border with Ukraine - at the closest proximity, 
since the invasion of Crimea in February.’”* 


Although the type of anti-air missile was not specitied, the Dutch Safety Board assumes 
that portable systems were referred to, because it is known that the aeroplane concerned 
was flying at a low altitude when it was downed. After a Mil Mi-8TV was downed on 
24 June near Slavyansk, at a press conference held in Brussels the U.S. Minister of Foreign 
Affairs, Kerry, also stated that it had been downed with a Russian weapon: ‘with a 
MANPAD RPG capacity that took that helicopter out.'”° 


A tew days later, on 30 June 2014, NATO General Breedlove spoke at a press conference 
about the build-up of Russian troops on the eastern side of the border with Ukraine 
(‘about seven-plus battalion task groups on the east side of that border, numerous small 
special operations forces'’°). Upon being asked, Breedlove revealed during the press 
conference that the Russian Federation also supplied anti-aircraft weapons to the armed 
groups that are fighting the Ukrainian government: 


94  http://usun.State.gov/briefing/Statements/228366.htm, consulted on 15 January 2015. 

95 http://mediarnbo.org/?p=277;http://www.rnbo.gov.ua/news/1711.html and http://www. State.gov/secretary/remarks/ 
2014/06/228444 htm, consulted on 14 March 2015. 

96 For the complete transcript of the press conference given by General Breedlove, see: http://www.defence.gov/ 
Transcripts/Transcript.aspx? TranscriptID=5456 (consulted on 14 March 2015). 
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‘To your last specitic question, yes, they do include that. What we see in training on the 
east side of the border is big equipment, tanks, APCs, anti-aircraft capability, and now we 
see those capabilities being used on the west side of the border.’ 


At a later point during the press conference he spoke of ‘vehicle-borne capability’ 
(weapon systems transported on vehicles), which were apparently being used for training 
on the eastern side of the Ukrainian border, even though there had not yet been any 
reports of their being spotted across the border: 


‘So there has been a release of NATO data on tanks. | believe YouTube has other vehicles, 
such as armoured personnel carriers. We have not seen any of the air defence vehicles 
across the border yet, but we’ve seen them training in the western part of Russia, et 
cetera. So | think that there are several types and capabilities of heavy weaponry that are 
moving across that border.’ 


The NATO general did not specify which weapons, nor whether medium or long-range 
surface-to-air missiles were involved. He did not explicitly state which parties were 
involved in the cited training: the Russian Federation and/or armed groups fighting 
against the Ukrainian government. Defence staff from other states doubted the accuracy 
of the information supplied by General Breedlove. They could not confirm it from their 
own observations.” 


Despite the Western political and military focus on the conflict, its escalation and its air 
component, none of the politicians or authorities quoted publicly made a connection 
between the military develooments in the eastern part of Ukraine and risks to civil aviation. 


5.5 Reports in the media related to possible available weapons capability 


In the months prior to 17 July, reports also circulated in the media (including social media) 
on the presence of weapons, including surface-to-air missiles, in the hands of the armed 
groups that were fighting the Ukrainian government in the eastern part of Ukraine.”® For 
example armed groups seized the Ukrainian military air defence base A-1402 on 29 June 
2014. Reports in the media indicated that, as a result, the armed groups had also been 


97 Interview with Dutch defence attaché. 

98 On 26 May, for example, a spokesperson of the Ukrainian armed forces revealed in the media that a surface-to-air- 
missile-system that was being used by armed groups near Donetsk airport had been destroyed from a helicopter 
by the Ukrainian army. On 5 June 2014, the International New York Times reported that armed groups received 
instructions on how to use ‘surface-to-air missiles, a 30-millimetre automatic grenade launcher, heavy machine 
guns and antitank weapons’. According to a leader of the armed groups these were weapons that the armed 
groups had seized from the Ukrainian army. A day later, the International New York Times reported that surface-to- 
air missiles had been seized from military bases. On 11 June, the newspaper Argumenty nedeli reported that 
armed groups had apparently downed between nine and eleven helicopters, two SU-25s and an An-30B in just 
one month. The same article also reported that a Buk-M1 system had been present in an area under the armed 
groups’ control. 
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able to acquire a Buk system. The Ukrainian authorities, however, declared in the media 
that this system was not operational.” '°° 


Western media reported that politicians, diplomats and military leaders expressed their 
concerns about weapons possibly being supplied by the Russian Federation to the 
armed groups and the build-up of Russian troops and equipment on the border with 
Ukraine. The involvement of the Russian Federation was denied in Russian media. 


The precise nature, scope and operational level of the military capacities of the various 
parties involved in the conflict around 17 July 2014 are not easy to establish by the Dutch 
Safety Board, even in retrospect. Although various media reported on the possible 
weapons Capability in the area in the months prior to the crash, they do not constitute 
validated and veritied information. In addition, based on open sources it is not possible 
to establish with certainty what equipment was involved and to what extent this 
equipment was operational. 


5.6 Non-public sources 


The Dutch Safety Board also used non-public sources pertaining to signals that could 
have indicated potential risks to civil aviation. These mainly are sources of the Kingdom 
of the Netherlands diplomatic mission in Ukraine. Much of this information originates 
from and/or was shared in closed briefings at which (mainly Western) diplomats, including 
defence attachés, discussed political and military developments in and around the 
conflict area. For this reason, the Dutch Safety Board assumes that the information that 
the Dutch diplomatic services possessed was also available - or could have been - to the 
representatives of other Western states. An investigation, commissioned by the Dutch 
Safety Board, was also conducted into the information possessed by the Dutch 
intelligence services; see Section 8 and Appendix T. The Dutch Safety Board did not 
have access to non-public sources from other states, such as Ukraine, the Russian 
Federation and Malaysia. 


From the non-public sources consulted it is clear that diplomats were extremely 
concerned about the military developments in the conflict area itself and on the Russian 
side of the border. The defence attachés of the various states held regular consultations 
on the situation in the eastern part of Ukraine, both as part of NATO and in a broader 
context.'°' They focused on military activities, especially those related to ground 
movements. In this respect diplomats took into account a possible invasion of Ukraine by 
Russian troops, which could result in major international tensions. They also discussed 
the armed groups fighting the Ukrainian government's interest in eliminating air 
superiority, and the fact that they were becoming increasingly effective in doing so: 





99 BBC Monitoring Former Soviet Union ‘Militants seize air defence unit in Donetsk, capture six Ukrainian troops’, 
29 June 2014, Russia and FSU General News,’ ‘Militia claims control over air-defense regiment in Donetsk’ (Part 2) 
29 June 2014, Interfax: Russia and CIS Military Newswire, 30 June 2014. 

100 Itar-TAS, ‘Donetsk defence forces take control of army unit equipped with missile defence systems’, http://TAS.ru/ 
en/world/738262, consulted 27 July 2015. 

101 This concerns states including Germany, Italy, France, Romania, Lithuania, Norway, Sweden, the US, the UK, 
Canada, Austria and Bulgaria. 
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‘Every third sortie was downed.’ The information that Ukrainian authorities provided 
during a briefing with diplomats about the shoot-down of an Antonov An-26, possibly 
from inside the Russian Federation,'°* was also placed in this geopolitical and military- 
strategic perspective: what would the consequences be for Ukraine’s domestic political 
stability and what risks would this and the possible Russian involvement entail for security 
in Europe? The same applied to the information that NATO possessed concerning 
military develooments and the build-up of weapons in and around the conflict area, as 
described by General Breedlove (see Section 5.4). 


During the aforementioned discussions, the diplomats present did not pose any 
questions about the safety of the airspace for civil aviation. Insofar as the Dutch Safety 
Board has been able to ascertain, the diplomats saw no reason, based on the content of 
the available information, to inform aviation authorities in their states about the situation 
in Ukraine. One of the sources stated: ‘At no point whatsoever did we think about the 
fact that civil aircraft were flying over the area.’ 


In response to such statements, made in interviews conducted by the Dutch Safety 
Board, diplomatic documents in which there were discussions about weapon systems on 
the ground and risks to civil aviation were expressly sought. The only relevant diplomatic 
document that the Dutch Safety Board was able to find is a memorandum about the 
situation in Crimea that Ukraine’s permanent representative to the OSCE issued to all 
OSCE delegations and cooperation partners. This memorandum, dated 7 March 2014, 
mentions, among other things, that Russian military troops had tried to take control of an 
air defence regiment, including the Buk missiles located there, belonging to the Ukrainian 
armed forces in Crimea. In this context the memorandum states: ‘The Ministry of Defense 
of Ukraine underlines that this kind of interference of the Russian servicemen in operation 
of the military unit of Ukraine causes real threat of illegal use of weapons against aircrafts 
in the airspace of Ukraine.’ However, this document does not explicitly mention risks to 
civil aviation either; it is also possible that the statement refers to risks to Ukrainian 
military aircraft. It must be emphasised that this memorandum refers to Crimea, not to 
the eastern part of Ukraine, and that it is dated the beginning of March, so before there 
was any armed conflict in the eastern part of Ukraine and over four months prior to the 
crash of flight MH17. 





102 Therein a flight altitude of 6,200 metres was mentioned. Also see Section 8.4 and Appendix T. 
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of Ukraine expanded into the airspace. According to reports by the Ukrainian ae 
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5.7. Sub-conclusions 


1. The aeronautical information of the U.S. aviation authority, FAA, (FDC NOTAM 
4/3635), valid from 4 until 31 March 2014, warned U.S. operators and airmen 
about the unstable situation and the increasing military activities in the entire 
airspace of Ukraine. 


2. Between the end of April and 17 July 2014, the armed conflict in the eastern part 


authorities, at least 16 Ukrainian armed forces’ helicopters and aeroplanes, 
including fighter aeroplanes, were shot down during this period. 


3. During the period in which the conflict in the eastern part of Ukraine expanded 
into the airspace, neither Ukraine nor other states or international organisations 


issued any specific security warnings to civil aviation about the airspace above 
1a oH 


Introduction to 
Part B 


the eastern part of Ukraine. 


4. The Russian NOTAM about the Rostov FIR, which became effective on 17 July 
and applied to Russian Federation airspace, made a precise reference to the 
conflict in the eastern part of Ukraine as a reason for restricting a few parts of the 
Russian airspace. This NOTAM was internally contradictory in terms of flying 
altitude. 


Part B: 
5 The situation 


5. On 14 July 2014, the Ukrainian authorities reported publicly and in a closed briefing 
with Western diplomats that an Antonov An-26 military transport aeroplane had 
been shot down from an altitude of between 6,200 and 6,500 metres. The weapon 
systems mentioned by the authorities in their statements are capable of reaching 
the cruising altitude of civil aeroplanes and would thus constitute a risk to civil 


aviation. Part B: 
7 Flying over 


Ukraine 

6. On 17 July 2014, the Ukrainian authorities reported that a Sukhoi Su-25 had been 
shot down over the eastern part of Ukraine on 16 July; in their opinion most 
probably by an air-to-air missile fired from the Russian Federation. The weapon 
systems mentioned by the authorities in their statements are capable of reaching 
the cruising altitude of civil aeroplanes. The Ukrainian authorities initially reported ee 
that the aeroplane had been flying at an altitude of 8,250 metres when it was hit. 9 Assessing the 


This altitude was later adjusted to 6,250 metres. Ec 
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This Section addresses the question why the airspace above the eastern part of Ukraine, 
a conflict area where the fighting had expanded into the airspace, was open above a 
certain restriction, allowing civil aviation to continue to fly over the conflict area. The 
central role of the Ukrainian State in this Section arises from the system of the distribution 
of responsibility in accordance with the Chicago Convention (see the diagram in Section 
4.2). As a sovereign state, Ukraine exerts full control over its airsoace and thus bears 
primary responsibility for its safety. Therefore, it can decide whether it is necessary to 
restrict or close the airspace to air traffic.'°° The signals related to the armed conflict and 
its expansion to the airspace, as described in Section 5, provide the context in which the 
State of Ukraine made decisions about the airspace above the eastern part of Ukraine. 


The following topics are addressed in this Section: 


e The organisation of Ukraine's airsoace management; 
e The airspace restrictions issued by Ukraine; 
e Airspace management in other conflict areas. 


In some cases the answers provided by the parties involved to the questions posed by 
the Dutch Safety Board were inconsistent. This is specified where applicable, and if 
necessary clarification is provided by the Dutch Safety Board. 


6.1. The organisation of Ukraine's airspace management 


Ukraine’s airspace was originally divided into five flight information regions (FIRs), namely: 
Lviv FIR, Kyiv FIR, Odesa FIR, Simferopol FIR and Dnipropetrovsk FIR (see Figure 78). On 
3 March 2014, Simferopol FIR was decommissioned and management of that part of the 
airspace was divided between the Odesa and Dnipropetrovsk air traffic management 
centres. 





103 Convention on International Civil Aviation, [CAO Doc 7300, Articles 1, 2 and 3a. 


a = y 4 191 or 277 









Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 
7 Flying over 
Ukraine 


Part B: 
9 Assessing the 
aL « 


ai 
Recommendations 


16 
List of appendices 





a 
Kyiv 
—— L980 
@ 
— al Dnipropetrovsk 
ty 2 
} 
- 
7 
* 
. Oy 
i. ~~ @ 
A Odesa 
; 
; @ 
wi Simferopol Py 
5% ineroeenre . - + 
(SIONS, MOA MSs oe, SEA, SISO) 10) ada) 
Usp asiRe einer 
me ae RS SUT a; 
ee Tie enPe ESA Eh SO Gey EO Geeks! © © 


Figure 78: Division of Ukraine’s airspace with airway L980. (Source: UkSATSE and Google, Landstat) 


For a number of flights from Europe to India and Southeast Asia, and vice versa, the 
most efficient route was the one across the eastern part of Ukraine. As a result, this route 
was very busy. Given the location of the routes, the flights also navigate the airspace of 
Dnipropetrovsk FIR (UKDY). 


The civil and military air traffic services in Ukraine were integrated in 1999 with the 
installation of the ‘Integrated Civil-Military ATM System of Ukraine (ICMS)’ as part of the 
UkSATSE air traffic control service. The civil and military air traffic control services each 
have their own command structure, but work closely together at the operational level. 
This cooperation is coordinated by the Ukraerocenter (the main operational unit in ICMS) 
in which the two services are represented as illustrated in Figure 79. 


UkSATSE is responsible for civil aviation air traffic control. Air traffic control for military 
aviation is provided by military units under the responsibility of the Ministry of Defence. 
Management of the airspace that falls under Ukraine's responsibility is implemented with 
flexible use of the airspace. The Ministry of Infrastructure and the Ministry of Defence are 
responsible for managing the airspace, at the strategic level, on the basis of a General 
Agreement. Management of the airspace at the pre-tactical and tactical level is 
implemented by ICMS as part of the system of their responsibilities. The civil-military 
coordination of traffic control at the operational level is, under normal circumstances, 
implemented by Ukraerocenter, air traftic control centres and the appropriate Ukrainian 
Air Force Divisions. UkSATSE has the mandate to close or restrict parts of the airspace 
for brief periods of time at the tactical level. Airspace closures and restrictions at the 
strategic or pre-tactical levels are coordinated by Ukraerocenter and the State Aviation 
Administration of Ukraine (SASU) in close cooperation with the General Staff of the 
Armed Forces. SASU exercises decisive authority with regard to airspace closures. 












Requests for airspace closures or restrictions are assessed on a regular basis if the 
requests are made for military training purposes. Requests for airspace restrictions are 
carried out without any further question if they are deemed necessary by the military 
authorities in relation to an armed conflict (the red dashed line in the diagram of 
Figure 79). These types of requests are considered to be decisions that have been taken 
at the highest level and are not discussed or influenced by UkSATSE or SASU. 
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Figure 79: Organisational chart for the air navigation services in Ukraine. (Source: UkSATSE) 


The Ukrainian aviation authority (SASU) took the formal decisions to close part of the 
airspace or restrict its use. Two of these decisions, namely restricting the use of the 
airsoace below FL260 and expanding this restriction to the airspace below FL320, are 
discussed in more detail below, because they are relevant to the assessment of the crash 
of flight MH17. 


6.2 Restricting the use of the airspace below FL260 


The investigation revealed that Ukraine’s military authorities had received information in 
June, prior to the crash of flight MH17, that ‘illegal armed units within the area of the Anti- 
Terrorist Operation’ '°* possessed weapons and the portable surface-to-air missile 
systems ‘Igla’ and ‘Strela’. The Ministry viewed the fact that Ukraine’s military aircraft 


104 The quote is taken from the reply of Ukraine’s Ministry of Defence. The Dutch Safety Board is not responsible for 
the terminology used. 
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were being shot at and shot down as an indication that these weapons were also being 
used. The investigation also revealed that the military authorities and UkSATSE discussed 
the incidents involving the military aeroplanes being shot down. On 5 June 2014 the 
military authorities requested the Ukrainian aviation authority to restrict civil aviation’s 
use of the airspace below FL260 to protect military aircraft from these attacks and to be 
able to give priority to air force operations. This request related to the area in which the 
Ukrainian Air Force was carrying out military operations, as well as the airspace used by 
the Air Force to fly to and from these areas. The requested airspace restriction to FL260 
became effective on the 6th of June and was extended on the (1st of July until and 
including the 28th of July 2014. 


The only air traffic permitted to fly in the restricted airspace was traffic that had received 
prior authorisation to do so and State aircraft.'°° According to the statement by the 
military authorities to the Dutch Safety Board, the assumptions for this were: 


e Asa result of the closure of the aerodromes at Luhansk (2 May 2014) and Donetsk 
(26 May 2014), there were no flights taking off or landing and thus no low-flying air 
traffic, only civil aeroplanes at cruising altitude. 

e According to the military authorities, there were no indications that ‘militants of illegal 
armed units’ '°° would attack a civil aircraft. ‘The shooting of civil aircraft by terrorists 
was not considered as a realistic scenario.’ According to the information available 
from the Ukrainian intelligence services and military authorities at that time, the 
‘illegal armed groups’ possessed MANPADS with a maximum altitude range of 
4,500 metres. 


Ukraine's military authorities realised that their military aircraft were a potential target for 
armed groups. To protect these aircraft, the military authorities calculated the altitude to 
which the airspace should be restricted to ensure that their aircraft could fly safely to and 
from the conflict area. They assumed a maximum altitude range of 4,500 metres for the 
MANPADS and applied a safety margin of 2,000 metres. The military authorities concluded 
that Ukrainian military planes could safely operate their flights to and from the areas where 
they conducted their missions at an altitude between 6,/00 and 7,300 metres 
(FL220 - FL240).'°’ Consequently, the military authorities deemed that civil aviation were 
sate above this altitude. There was no military air traffic in an additional buffer which was 
applied up to FL260. The authorities provided the following reasoning: ’...the establishment 
of temporary prohibitions of airspace use in the specified regions to ensure flight safety 
for civil aviation considering the military aviation operations.’ The response to a different 
question also revealed that the authorities only considered the safety of civil aviation in 
relation to the activities by military aircraft: ’...this restriction of airspace use was introduced 
to provide flight safety of civil aircraft in the regions of military aviation operations...'. A 
possible threat to civil aviation from the ground did not play an explicit role in establishing 
the airspace restriction to FL260. The restriction to FL260 arose trom the need to improve 
safety and create more airspace for military aeroplanes and to separate military from civil 





105 The official ICAO name for aircraft used by military, customs and police services. 

106 The terms in the quotes are those used by the Ukrainian authorities. The Dutch Safety Board uses the term ‘armed 
groups that fight the Ukrainian government’. 

107 As of 3,500 feet, altitudes are calculated in flight levels (FL). 
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aviation. The assumption was that civil aeroplanes that flew above the altitude of FL240, 
which was deemed safe for military aeroplanes, were also safe. 


In an interview, those responsible at UkSATSE stated that they had no influence on the 
decision to restrict the use of airspace. They stated that they were merely informed of 
the decision. With regard to the background of the decision, they stated that they only 
knew that it was to protect civil aviation in relation to military activities. 


The Dutch Safety Board deduces, from answers to written questions and documents that 
were supplied, that the Ukrainian Air Force submitted the request to UkSATSE for further 
processing of the temporary airspace restriction below FL260. UkSATSE processed this 
request and sent it to the military authorities for verification. Once the General Staff 
agreed to the details, it sent the request to the Ukrainian aviation authority, SASU. 
Therefore, the decision pertaining to the request involved the General Staff of the Armed 
Forces, the Ukrainian Air Force, the aviation authority SASU and air navigation service 
provider UkSATSE. 





clea Nae] get Processing UkSATSE elu ges Ueu Formal decision SASU 
of the Armed Forces 


Figure 80: Diagram of Ukraine’s decision-making process related to FL260. (Source: Dutch Safety Board) 


It has not been clarified whether all parties involved were fully aware of all the available 
information. The sources are contradictory on this matter. However, it is clear that the 
initiative to restrict airspace use originated from the military authorities and that the other 
parties were indeed informed of the formal decision. Other parties’ influence was limited 
despite existing consultation structures and the cited provision of information. UkSATSE 
said that it did not receive any detailed information related to the threat or about the 
exact reasons for the requested restrictions. 


In later interviews of the Dutch Safety Board with, for example, the Ukrainian Ministry of 
Defence, interviewees stated that, due to a lack of technical resources, the armed forces 
would not have been able to observe whether aircraft (including military aircraft) made 
unauthorised use of the airspace. According to the authorities, it was also impossible to 
obtain an effective picture of the potential presence of powerful missile systems in the 
area under the control of the armed groups that are fighting the Ukrainian government. 
However, the military authorities had no indications that the armed groups possessed 
medium or long-range surface-to-air missiles. 


6.3 Restricting the use of the airspace below FL320 
Following the restriction of the use of the airspace below FL260, Ukraine issued a 


restriction for the airspace below FL320 on 14 July 2014. That was three days before 
flight MH17 crashed and the same day as an Antonov An-26 was downed, according to 
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the Ukrainian authorities, at an altitude of 6,500 metres'°° (see Section 5). This additional 
restriction was initiated by UkSATSE. 


Ukraine’s aviation authorities stated that the further restriction to FL320 in the area, 
submitted by UkSATSE, was not connected in any way to the Antonov An-26 being shot 
down earlier that day. They stated that the increase had been requested prior to 14 July 
and that it had been based on general information and was intended to increase the 
altitude buffer between military and civil aviation: ‘’... made a decision on the necessity to 
set additional buffer zone FL260-FL320 in order to ensure flight safety of civil aircraft 
related to operations of the state aircraft of Ukraine within the prohibited airspace...’ The 
crash of the Antonov An-26, according to UkSATSE, had resulted in the decision being 
speeded up. According to the authorities, there were no indications that pointed to a risk 
to civil aviation above FL260: ‘There were no grounds to expect threats to flight safety of 
civil aircraft above FL260 taking into account the buffer zone up to FL320...' 


In response to a written question, UkSATSE stated that, based on Ukrainian legislation, 
there were no grounds for full closure of the airspace above the eastern part of Ukraine 
to civil aviation. At that time, the airspace could only be closed if there had been an 
official request from the competent authorities, or if there had been information related 
to a risk to the safety of civil aviation in a particular part of the airspace. Neither of these 
scenarios applied. 





Google earth 


Figure 81: Position of restricted airspace according to Ukrainian NOTAMs in relation to airway L980. (Source: 


Google, Landstat) 
On 17 July 2014, the day of the crash of flight MH17, the use of the airspace above the 


eastern part of Ukraine was restricted below FL320. The airspace above FL320 was open 
to civil aviation. After an emergency beacon was activated at around 13.20, indicating 


} In written replies to questions posed by the Dutch Safety Board this was later adjusted to 6,300 metres. 
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that flight MH17 had crashed, UkSATSE made the decision at 15.00, at the tactical level, 
to also restrict the airsoace above FL320. From that moment, only military aircraft were 
permitted to fly in that area (NOTAM A1507/14). This meant that the entire airspace above 
the eastern part of Ukraine was closed to civil aviation. 


6.4 Consequences of the airspace restrictions 


6.4.1 Air traffic 

EUROCONTROL data from 2014 and interviews conducted with Ukrainian air navigation 
service provider UkSATSE revealed that the airspace restrictions from 6 June (FL260) and 
14 July 2014 (FL320) barely resulted in any changes to the number of civil flights in and 
through Ukraine's airspace as a whole (see Figure 82). At the end of March/beginning of 
April 2014, a decrease in the total number of flight movements was observed (see 
Figure 82). Around this time, Ukraine issued a NOTAM and ICAO published a State Letter 
about the situation in Crimea (see Section 5) that possibly explains this decrease. Since 
this figure relates to Ukraine as a whole, it is not easy to see what happened in the eastern 


part of Ukraine. Possible seasonal effects may also have affected the figures. 
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Figure 82: Daily flight movements in Ukraine’s airspace as a whole. (Source: EFROCONTROL) 
After the airspace had been completely closed on 17 July 2014, the average number of 


flight movements in Ukrainian airspace as a whole fell from approximately 1,300 per day 
to approximately 700 a day (see Figure 83). 
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Figure 83: Flight movements in Ukraine's airspace as a whole around 17 July 2014. (Source: EJROCONTROL) 


6.4.2 Financial consequences 

Every sovereign state receives compensation for air traffic services from the operators 
using its airspace (route charges). Media reports speculated that Ukraine may have left 
its airsoace open so as not to lose any revenue from route charges. The financial 
importance of keeping one’s airspace open was also emphasised in various discussions 
that the Dutch Safety Board conducted with aviation experts. Therefore, the Dutch Safety 
Board investigated Ukraine’s revenue from route charges. 


In this procedure, Ukraine has adopted the so-called ‘full cost recovery system’. This means 
that the state recuperates the costs related to air traffic services from the operators through 
this charge. The budget and estimated traffic volumes for the coming year determine the 
amount of the charge. The budget is based on the actual costs incurred in the previous year. 


In Europe, EUROCONTROL,'°’ on behalf of its Member States, calculates these charges 
for international flights and invoices the operators that use the airspace involved. After 
receiving the charges, EUROCONTROL transfers the money to the states concerned. 
Since Ukraine could not meet the conditions that EUROCONTROL imposes on states that 
want to participate in this system, EUROCONTROL and Ukraine concluded a bilateral 
agreement. Based on this agreement, EJROCONTROL calculated and collected the route 
charges and transferred them to Ukraine. This agreement ended at the end of 2013.''° 


109 See Section 4 for an explanation of EXROCONTROL's tasks. 
110 EUROCONTROL was able to supply financial data for 2013, but not for 2014. 
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EUROCONTROL's statement revealed that in 2013, Ukraine had received over EUR 
199 million in route charges for all international flights that had flown through Ukraine's 
airsoace. EJROCONTROL could not provide any figures for 2014 due to the agreement 
with Ukraine ending. 


In order to give an indication of the financial consequences of the closure of the 
Dnipropetrovsk FIR after 17 July 2014, the Dutch Safety Board estimated the revenues 
per day using EUROCONTROL's statement of the number of international flights that had 
flown through the Dnipropetrovsk FIR between May and July 2014. To do so, the Dutch 
Safety Board counted the number of flights per aircraft type on two random days, 1 April 
and 15 June 2014, and then calculated the route charges. The estimated charges 
amounted to approximately € 176,000 on 1 April 2014 and approximately € 248,000 on 
15 June 2014.""' 


According to UkSATSE, the decrease in revenues resulted in financial problems that were 
solved by adjusting the budget and obtaining external funding. In an interview with the 
Dutch Safety Board in December 2014, UkSATSE estimated that the closure of the 
airspace above the eastern part of Ukraine in the second half of 2014 resulted in a 7-9% 
loss in revenues compared with the budgeted revenue for 2014. In 2015, from the figures 
provided by UkSATSE, it appeared that revenues from route charges in 2014 had 
decreased by 13% compared with 2013. This was the result of all the measures combined 
and operators’ reactions to the developments in Ukraine in the second half of 2014. In an 
interview, UkSATSE stated that the decrease in revenues played no role in the decision to 
restrict use of the airspace. 


6.5 Airspace management in other conflict zones 


To put the decision-making process in Ukraine into perspective, the Dutch Safety Board 
also examined airspace management in other states where an armed conflict is taking 
place. There are multiple conflict areas throughout the world with potential risks for 
international civil aviation. Each conflict area has its own characteristics, but there are 
also common factors. The Dutch Safety Board compiled an inventory of possible air 
restrictions above a number of conflict areas based on the situation up to and including 
mid-July 2015. It also broadly examined available information related to the weapon 
systems present. Where medium or long-range surface-to-air missiles are mentioned, 
the Dutch Safety Board refers to missiles that can hit a civil aeroplane at cruising altitude. 
This Section also describes the measures taken by states with regard to the airspace in 
the conflict areas.''” 





111. The route charges depend on the maximum weight of the aircraft, a state’s unit rate and the distance travelled 
through the airspace of the state concerned. For the dates mentioned, the weight factor per aeroplane type was 
calculated for all flights and multiplied by the unit rate and the distance. The average distance was estimated at 
1,000 kilometres. The unit rate for 2014 was estimated using route charge data from 2013. 

112 The Board was not in all cases able to ascertain when the first warnings or NOTAMs concerning the airspace were 
published by other states. The warnings or NOTAMs that were in force at the moment of investigation could have 
been preceded by others that are no longer visible in the databases concerned. 
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6.5.1 Northern Mali 

In Mali there is a conflict between non-state armed groups and the government involving 
military air activities. Insofar as the Dutch Safety Board could ascertain, until April 2015, 
there were no indications that the non-state related groups possessed medium or long- 
range surface-to-air missiles (with a greater range than MANPADS). 


The competent body for the airsoace concerned (DRRR) issued a NOTAM about the 
prohibited (GND-FL320) and restricted (FL320-400) areas. The U.S. authority, the FAA, 
issued an FDC NOTAM 4/9775 advising U.S. operators and airmen of civil aviation threat 
concerns in Mali.'’’ The restrictions pertaining to the airspace above Northern Mali had 
already been in place since 2013, and are partly due to the presence of an intervention 
force led by France. The latter also conducts military air operations. 


6.5.2 South Sudan 

Different groups in the state of South Sudan are engaged in combat. The fighting broke 
out in December 2013, but helicopters had already been downed in 2012. It is assumed 
that the parties involved possess MANPADS. There are no large-scale military air activities 
and there are no indications that any of the parties possess medium or long-range 
surface-to-air missiles. Sudan probably possesses these kinds of weapons, but it does 
not appear to be interfering in the conflict in South Sudan. 


Above the territory of South Sudan, air traffic control above FL270 is delegated to the air 
traffic control centre at Khartoum. The competent authorities have not issued any 
NOTAMs, but the authorities in the United States and the United Kingdom have done 
so.''*'"'5 France issued an Aeronautical Information Circular (AIC)."'° It did so after 
17 July 2014. Insofar as is known, most operators fly over this area at an altitude higher 
than FL260, in accordance with the recommendations in the cited NOTAMs and AIC. 


6.5.3 Libya 

After the fall of President Gaddafi in 2011, an armed conflict erupted between different 
groups. Advanced weapons are present in the country, including medium or long-range 
surface-to-air missiles, but it is not known where they are and who controls them. The 
infrastructure of Libya’s air traffic control has largely been destroyed and only sporadic 
military air activities are conducted. 


The government has issued a NOTAM which requires that aircraft have prior permission 
to enter the airspace (overflight PPR). 





113. FDC NOTAM 4/9775: U.S OPERATORS AND AIRMEN SHOULD AVOID FLYING INTO, OUT OF, WITHIN OR OVER 
MALI AT OR BELOW FL240. 

114 FDC NOTAM 472189: THOSE PERSONS DESCRIBED IN PARAGRAPH A SHOULD AVOID FLYING INTO, OUT OF, 
WITHIN OR OVER THE TERRITORY AND AIRSPACE OF SOUTH SUDAN AT ALTITUDES BELOW FL260. 

115 NOTAM V0013/15. 

116 AIC FRANCE A 05/15. 
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The U.S. FAA and U.K. CAA,"’ and also the German CAA,''® prohibited operators from 
flying in the Tripoli FIR. The French authorities have issued a similar request to French 
operators. Additionally, ICAO issued a warning in January 2015 about flying in the Tripoli 
FIR as did EASA in March 2015. The restrictions related to the airspace originate from 
before 17 July 2014. 


6.5.4 Syria 

In Syria there is a conflict between the government and various armed groups. It is unclear 
whether these groups possess medium or long-range surface-to-air missiles. There are 
military air activities, some of them on a large scale. In this conflict, it is important that 
intelligence services assume that the groups have the intention of hitting Western targets. 


On 22 March 2013, ICAO issued a State Letter related to Syria. It warns states about 
potential serious safety risks in the Damascus FIR. Syria has not issued a NOTAM. On 
31 July 2014, France issued a warning to French operators not to fly in the Damascus FIR. 
Since 18 August 2014, an FAA flight prohibition has been in place prohibiting U.S. 
operators from flying in the Damascus FIR."'? On 30 March 2015, the U.K. has published a 
warning not to fly over Syria.'*° The U.S. flight prohibition and French warning date from 
after the crash of flight MH17. EASA also issued another warning in August 2014.'*' 


6.5.5 lraq 

The armed conflict in Syria has expanded to Iraq. The intensity of this conflict increased 
throughout 2014. The non-state related groups possess anti-aircraft missiles, including 
MANPADS, as well as light weapons. Since the armed groups operate in both Syria and 
lrag, there is the chance that they get hold of medium or long-range surface-to-air 
missiles in Iraq. There are ongoing military air activities too, some of them on a large 
scale. Western intelligence services assume that the armed groups have the intention of 
hitting Western targets. 


lraq has not issued any NOTAMs pertaining to the armed conflict. On 1 July 2013, the 
U.S. FAA decided that U.S. operators and airmen were only permitted to fly over the area 
above FL200.'** Following the crash of flight MH17, most operators reviewed decisions to 
fly over this area. On 8 August 2014, the FAA announced a flight ban for the entire 
Baghdad FIR.'* The United Kingdom and France issued a warning not to fly in Iraqi 
airspace. Mid-July 2015, Germany also issued a warning. In February 2015, ICAO issued 
an urgent recommendation to assess the safety risk related to using Iraqi airspace.'** In 
April 2015, EASA issued a bulletin that highlights a number of these warnings.’ 


117. US SFAR 112 and UK V0017/15. 

118 http://webcache.googleusercontent.com/search?q=cache:1NMIJfXoT0sJ:m.omvi.de/SharedDocs/DE/Artikel/LR/ 
verbot-luftraum-libyen.html%3Fnn%3D62482+andcd=1andhl=nlandct=clnkandgl=nl, consulted on 21-08-2015. This 
prohibtion was in force till 31 July 2015 and was no longer visible in the ICAO repository in August 2015. 

119 US FDC NOTAM 4/4936 and US SFAR 114. 

120 UK NOTAM v0016/15. 

121 EASA SIB 2014-25. 

122 US SFAR 77. 

123. US FDC NOTAM 4/1621 followed by FDC NOTAM 4/2185. 

124 ICAO Electronic Bulletin EB 2015/15. 

125 EASA SIB 2014-24/7R1. 
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6.5.6 Egypt (Sinai) 

In the Sinai there is an ongoing conflict between the government and non-state groups. 
The latter probably possess MANPADS. In the Sinai there is no military air activity (i.e., air 
attacks, transport of troops and weapons). Insofar as the Dutch Safety Board has been 
able to ascertain, there are no indications that point to the presence of medium or long- 
range surface-to-air missiles. 


On the basis of Egyptian NOTAMs, in November 2014, EASA issued a SIB '*° that warns 
of a significant risk to aircraft below FL260 in the area concerned. At the moment '’’ there 
are no active Egyptian NOTAMs with regard to Sinai. 


In November 2014 the FAA issued in a NOTAM informing U.S. operators and airmen of 
civil aviation threat concerns in the Sinai.'*° In 2015, the authorities in the United 
Kingdom'*’ and Germany’ issued NOTAMs, warning of a potential risk of anti-aircraft 
missiles to aviation. 


6.5.7. Afghanistan 

In Afghanistan, there is a conflict between the Government and non-state groups. Many 
weapons are present, including MANPADS, and there are military air activities (including 
unmanned aircraft). Insofar as the Dutch Safety Board has been able to ascertain, there 
are no indications that the non-state groups possess medium or long-range surface-to- 
air missiles. 


Afghanistan has not issued any NOTAMs that refer to risks resulting from armed activities. 
The U.S. authorities have issued a warning to U.S. operators not to fly below FL260,"°' 
and there is an EASA Safety Information Bulletin '°* that refers to an expired U.S. NOTAM 
(FDC NOTAM 4/8757). The French authorities issued a circular that requests French 
operators not to fly over Afghanistan below FL240.'** The United Kingdom had not 
published active NOTAMs related to Afghanistan, but was in process of doing so. Many 
international flight routes between Europe and Southeast Asia cross Afghanistan. Some 
operators are known to have developed internal guidelines for flying over Afghanistan, 
including a minimum overflight altitude (usually FL260). 


6.5.8 Somalia 

In Somalia, there are various internal groups that are engaged in conflict. The state’s 
control is limited. Many weapons are present here too, including MANPADS, but as far as 
the Dutch Safety Board has been able to ascertain, there are no indications to point to 
the presence of medium or long-range surface-to-air missiles. The conflict had not 
extended into the airspace at the time the analysis was performed (July 2015). 





126 EASA SIB 2014-30/R1. 

127 Beginning of August 2015. 

128 FDC 4/8353, currently FDC 5/9155. 

129 UK NOTAM V001/15. 

130 Germany NOTAM 19-07-2015. http://www.bmvi.de/SharedDocs/DE/Artikel/LR/verbot-luftraum-jemen.html. 
Consulted on 19 August 2015. 

131 US FDC NOTAM 4/2181. 

132 EASA SIB 2014-26. 

133 AIC FRANCE A 05/15. 
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The Somali authorities have issued a warning to be extremely cautious when operating 
flights to Mogadishu Airport, due to the lack of information pertaining to armed activities 
and a lack of aeronautical information.’** The U.S. authorities have imposed a long-term 
prohibition for U.S. operators and airmen flying over Somalia below FL200.'*° Non-U:S. 
operators also apply this lower limit to their flights over Somalia. 


6.5.9 Yemen 

In Yemen, non-state groups are involved in an armed conflict with the government and 
neighbouring states. There are many weapons in the area, including MANPADS. There 
are also extensive activities with unmanned aircraft. Large-scale military air operations 
have been underway since the end of March 2015. There are no indications that point to 
medium or long-range surface-to-air missiles being present in the area. 


Yemen has NOTAMs pertaining to shifting routes over the sea in order to avoid the 
armed conflict. Saudi Arabia has airspace restrictions on the border with Yemen. The U.S. 
FAA issued an emergency regulation constituting a total flight prohibition on flying in 
Yemen's airspace.'°° The authorities in the United Kingdom and France issued a warning 
with the same scope as the U.S. flight prohibition.’°’ Germany ‘°° and the United Arab 
Emirates also issued a flight prohibition. 


6.5.10 Democratic Republic of the Congo 

In the Democratic Republic of the Congo, there is an ongoing armed conflict in the 
eastern part of the country. The state’s control over that area is limited. Various non-state 
groups are active. Insofar as the Dutch Safety Board has been able to ascertain, there are 
no indications that medium or long-range surface-to-air missiles are present in the area, 
or that military air operations of any scale are being carried out. 


The Democratic Republic of the Congo has not issued any NOTAMs referring to the 
conflict. The U.S. FAA has issued a warning to U.S. operators, advising them to make 


sure that they are informed about the current situation before flying in that area.'°’ 


Table 21 summarises this information. 





134 HCMM A0006/15, 27 February 2015. 

135 US SFAR 107 and FDC NOTAM 7/7201. In May 2015 this was raised to FL260. 

136 US FDC NOTAM 5/8051 (A0010/15). 

137. UK NOTAM V0012/15 and AIC FRANCE A 05/15. 

138 Germany NOTAM 19-07-2015. http://www.bmvi.de/SharedDocs/DE/Artikel/LR/verbot-luftraum-jemen.html. 
Consulted on 19 august 2015. 

139 US FDC NOTAM 8/7569. 
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Conflict zone Sovereign State NOTAMs Other States International 
organisations 


Eastern part of FL320 (restriction), later closure | US, UK, France ICAO, EASA 
Ukraine'° 
Northern Mali Up to FL320 (closure)/ FL320- US EASA 

400 (restriction) 
South Sudan No US, UK, France EASA 
Libya Overflight PPR US, UK, France, FRG ICAO, EASA 
Syria No US, UK, France ICAO, EASA 
Iraq No US, UK, France, FRG ICAO, EASA 
Egypt (Sinai) No'*! US, UK, FRG EASA 
Afghanistan No US, France EASA 
Somalia Warning pertaining to US 


Mogadishu airport 


Yemen No US, UK, France, FRG, EASA 
UAE 

Dem. Rep. No US 

Congo 





Table 21: Overview of decisions related to airspace restrictions above conflict areas with non-state armed 


groups (July 2015). 


Table 21 demonstrates that, in the ten conflict areas examined by the Dutch Safety Board, 
the relevant states did not close their airspace to civil aviation at cruising altitude, with 
the exception of Libya. This state issued a NOTAM that imposed a requirement to obtain 
authorisation to fly over the area - a so-called ‘overflight PPR’ - which functions as a de 
facto flight prohibition. It is also notable that, in most cases examined here, the states 
concerned did not issue any NOTAMs containing information about the conflict, which 
airspace users could have used in their own risk assessments. 


Indications that there are potential risks to overflying civil aviation resulting from armed 
conflicts often originate from third parties, such as aviation authorities in other states or 
international organisations such as ICAO and EASA. The United States in particular, and 
to a lesser extent the United Kingdom, France and Germany, issued flight prohibitions or 
warnings to operators from their respective states with regard to operating flights above 
conflict areas. More often than not, these were recommendations not to fly over an area 
below a certain altitude." The number of states promulgating warnings or flight 
prohibitions seems to have increased since the crash of flight MH17 and the creation of 
the ICAO website enabling the exchange of such information.'*° 





140 On 17 July 2014, prior to the crash of flight MH17. 

141 This was the situation in 2015; in 2014, it did. 

142 Often around FL 250 to remain out of range of MANPADS. 

143 ICAO Conflict Zone Information Repository, http://www.icao.int/czir/Pages/default.aspx. 
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Armed conflicts, specifically involving non-state groups, are characterised by a high 
degree of unpredictability. It is difficult to establish who possesses which type of 
weapons systems and whether or how they will be used in the conflict. Non-state parties 
in a conflict do not necessarily feel bound by international treaties and conventions, in 
which shooting at civil aeroplanes is emphatically condemned. Moreover, the spread of 
powerful weapon systems increases the risk of civil aeroplanes being shot down 
unintentionally. As a result of the above, such conflicts can carry risks to civil aviation. 


The weapon systems that could hit civil aviation at cruising altitude are primarily powerful 
anti-aircraft missiles. MANPADS are present in most of these conflict areas, but their 
range is inferior to the altitude at which civil aircraft overfly. However, weapon systems 
may also be present in a state where an armed conflict is being fought, which can actually 
constitute a risk to civil aviation at cruising altitude. In conflicts in which states which 
possess these types of weapon systems are (directly or indirectly) involved, it is possible 
that these weapons will be used, by the state itself or by others. A number of conflict 
areas have seen fighting groups seizing such types of systems that pose a threat to civil 
aviation from the state’s armed forces. It cannot be ruled out that these groups possess 
the knowledge and skill needed to actually use the seized systems, or that they are able 
to obtain the necessary knowledge and skill to do so. Current threat analyses assume the 
indication of the actual possession of weapons and not the possibility of non-state parties 
being able to acquire powerful weapon systems. 


6.6 Analysis: Ukrainian airspace management 


Management of the airspace above a country is an exclusive right of the sovereign 
state.'** From this exclusive right, the Dutch Safety Board also derives a large responsibility 
borne by the state concerned. For the purpose of this management, the state has the 
exclusive power to close the airspace (or a part thereof) or restrict its use if there is a 
reason to consider such a measure. Safety and security risks to civil aviation constitute an 
important reason for restricting airsoace use. Formal management at the strategic level 
of the airspace in Ukraine is the responsibility of the Ministry of Infrastructure’? in 
accordance with the Ministry of Defence. The actual management is the responsibility of 
the executing civil and military organisations between which, under normal circumstances, 
management is coordinated. 


6.6.1 Airspace management measures and assessing risks to civil aviation 

During the armed conflict in the eastern part of Ukraine, the initiative for taking measures 
related to the airspace, based on safety analyses, originated from the military authorities. 
The findings of the Dutch Safety Board, as reported above, mean that it is plausible that 
decisions related to the airspace were primarily taken from the perspective of the 
military's interest, in which a potential risk to civil aviation was not the subject of any 


144 Chicago Convention, Articles 1 and 2. See also Section 4 and Appendix QO. 
145 See the figure in Section 6.1. 
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explicit consideration. The procedure established in Ukraine, for the introduction of a 
restriction or closure of the airspace, was indeed followed. This approach is also in 
accordance with the purpose of ICAO Circular 330 AN/189.'*° 


One of the measures that Ukraine took was to restrict civil aviation’s use of the airspace 
above the eastern part of Ukraine below FL260. This involved the reasoning that military 
air traffic had to be able to fly unhindered to and from the areas where operations were 
being conducted and be safe from attacks from the ground. Furthermore, military and 
civil aviation had to be separated to ensure the safety of civil aviation. When establishing 
this restriction at FL260, the military authorities assumed that the armed groups that 
were fighting the Ukrainian Government only possessed MANPADS with a maximum 
altitude range of 4,500 metres. 


The decision was thus based on the possibility that military aeroplanes could be hit by 
weapons from the ground. The Ukrainian authorities therefore assumed that the safety of 
civil aviation above FL260 was automatically sateguarded. Therefore, no explicit risk 
assessment was performed for civil aviation. The military authorities did not view the 
possibility that civil aeroplanes were at risk of being hit from the ground at cruising 
altitude as realistic, because they did not possess any information that indicated the 
armed groups had weapons that could reach cruising altitude, and that these groups did 
not have the intention to shoot at civil aircraft. 


6.6.2 Antonov An-26 and Sukhoi Su-25 

On 14 July 2014, the Ukrainian authorities announced in a press statement that an 
Antonov An-26 had been shot down while flying at an altitude of 6,500 metres. Later, 
altitudes of 6,200 '”” and 6,300 metres were also cited. All these altitudes are out of the 
range of MANPADS. According to the authorities, the aircraft was shot down with a 
weapon that could reach the cruising altitude of civil aircraft. 


On 14 July, the Ukrainian authorities closed the airspace below FL320 to civil aviation. The 
Dutch Satety Board was not able to establish whether this was a direct result of the 
shooting of the Antonov An-26. According to the Ukrainian authorities there was no 
connection and they stated the measure had been planned prior to, but was accelerated 
as a result of the incident. They stated that the aircraft had been shot down below FL230- 
240, which the military authorities had considered to be safe for military aeroplanes. As a 
result, the authorities believed that there was no threat to civil aircraft above FL320. 


One can conclude, from statements made by the Ukrainian authorities, that it was 
possible that weapon systems were used that could reach the cruising altitude of civil 
aircraft. According to the Ukrainian authorities, this probably took place from inside the 
Russian Federation. They state that they could not have taken this into account in their 
risk assessment because they are not able to assess unexpected threats posed by 
unannounced military activities from another state. 





146 The circular states: ‘During any crisis situation, there will be a requirement for increased coordination between civil 
and military ATM authorities in order to allow civil aviation to continue to operate to the maximum extent possible, 
while facilitating operational freedom for military air operations.’ 

147 On 14 July in a briefing given by Minister for Foreign Affairs Klimkin to Western diplomats at the Ukrainian 
Presidential Administration. 
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However, the safety of a state’s airspace is the exclusive responsibility of the sovereign 
state concerned, in this case, Ukraine. As of 14 July, the threat posed by attacks from 
weapon systems with a greater range than MANPADS, whether or not originating from 
another state was, in any case, real to the Ukrainian authorities. This was confirmed on 
16 July, when a Sukhoi Su-25 was shot down, while flying, according to the Ukrainian 
authorities, at an altitude of 6,250 metres (an altitude of 8,250 metres was originally stated 
in a press statement dated 18 July 2014). The Ukrainian authorities claimed that this was 
also attacked from the Russian Federation, probably using an air-to-air missile, but they 
did not exclude the possibility of a surface-to-air missile. This incident did not lead to any 
further restriction or closure of the airspace. Though the Ukrainian Air Force did suspend 
military sorties for tactical reasons on 16 July, after the shooting of the Su-25. Since the 
authorities assumed that the weapons were exclusively used against military aeroplanes 
and because no new flights were planned after 16 July 2014, they assumed that there 
were no additional threats to civil aviation. The Dutch Safety Board considers this risk 
assessment to be incomplete because it does take threats to military aircraft into account, 
but does not account for the consequences to civil aviation of potential errors or slips. 


6.6.3 Other considerations related to airspace management 

It is conceivable that considerations other than those related to safety could also have 
played a part in Ukraine’s decision not to completely close the airspace to civil aviation, 
such as possible financial consequences. A complete closure may also have given the 
impression that the state had lost control over a part of its airspace. Such factors do not 
appear to have played a role in the decision to keep the airspace open at cruising altitude. 


6.6.4 Airspace management pertaining to conflict areas 

Risks to civil aviation may arise in conflict areas if military air activities are being carried 
out and if medium or long-range surface-to-air missiles or air-to-air missiles are being 
used in the armed conflict. The study of a number of conflict areas shows that sovereign 
states, which are responsible for managing the airspace, rarely close the airspace; they 
may, on occasion, and possibly temporarily, restrict the altitude at which civil aircraft are 
allowed to fly and they do not share any or virtually any information about the armed 
conflict with airspace users. The airspace management by the State of Ukraine above the 
conflict area in the eastern part of Ukraine fits this pattern. 


Ukraine’s NOTAMSs related to the eastern part of Ukraine do not state the reason for the 
airspace restrictions, as recommended in ICAO Doc 9554-AN/932. As a result, airspace 
users were not informed to the greatest possible extent. States involved in other conflict 
areas also barely inform airspace users, which is inconsistent with ICAO recommendations. 
Section 7 discusses the decision-making process related to the use of the airspace in the 
eastern part of Ukraine. 


In the (non-binding) document Doc 9554-AN/932, ICAO recommends that, in the case of 
conflicts, information should be provided in NOTAMs about the nature of a threat that 
forms the rationale for the NOTAM. Below is an example from Doc 9554 of how this type 
of information could be provided. 
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Example from Doc 9554 


GG DCBAYNYX ACCOYNYX BADCYNYX.. 

171814 CBADYNYX 

A747 NOTAMN 

A) CBAD FIRB) WIEC) UFN APRX DUR 

E) PARAMILITARY FORCES REPORTED OPERATING IN AREA (describe area with 
reference to latitude and longitude). CIVIL AIRCRAFT ARE REQUESTED TO 
MAINTAIN AT LEAST FL. WHILE TRANSITING THE AREA IN ORDER TO AVOID A 
POTENTIAL THREAT (describe threat). 


Meanwhile, ICAO is working on expanding the NOTAM system to include information 
related to threats. Details in the NOTAMs and the threats could be posted on a website 
created especially for this purpose. ICAO prefers this to the inclusion of the information 
in the NOTAMs.'*® This means that this information will mainly have to be provided by 
states other than the one managing the airspace. This agrees with the Boara’s conclusion 
that instructions that the airspace over a conflict zone is becoming more hazardous are 
usually provided by other states or international organisations. At the same time, ICAO 
Doc 9554 stipulates that states should identify the geographical conflict area in their 
territory, analyse the dangers and potential dangers to civil aviation and should determine 
whether civil aviation must avoid the conflict area or can continue to operate there 
subject to certain conditions. However, the expansion of the NOTAM system does not 
change the fact that the states responsible for the air traffic services should issue an 
international NOTAM, which includes the necessary information, recommendations and 
safety measures to be taken and that they must then continue to update it to reflect any 
developments. '*’ 


6.6.5 Distribution of responsibility 

The sovereignty of states is one of the fundamental principles of the Chicago Convention, 
one of the stated objectives of which is the safe development of aviation.'°° This not only 
means that states have complete control over their airspace, but that they are also 
responsible for ensuring the safety of the airspace that is open to civil aviation. The Dutch 
Safety Board's investigation has demonstrated that, in practice, this fundamental principle 
can lead to vulnerability. The fact that the state manages the airspace does not mean 
that, in all cases, it has an adequate overview and control of weapon systems that could 
threaten the safety of that airsoace from the ground or in the air. This turned out to be 
the case in the eastern part of Ukraine. This raises the question how states that are 
involved in an armed conflict can be motivated to fulfil their responsibility more than is 
currently the case. ICAO’'s applicable Standards, Recommended Practices, and guidance 
materials evidently provide insufficient guidance for taking a considered decision about 
airsoace management. The Dutch Safety Board is of the opinion that airspace users 
should be able to count on unsafe airspace being closed to civil aviation and that, in any 





148 ICAO Working Paper HLSC/15-WP/9, 19-1-2015. 
149 ICAO Doc 9554-AN/932, paragraph 10.3. 
150 Convention on International Civil Aviation, |CAO Doc 7300, Preamble. 
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case, airspace users should be adequately informed about the nature of the conflict and 
the underlying reasons for measures such as a (temporary) altitude restriction. This does 
not alter the fact that airspace users also have their own responsibility with regard to safe 


flight operations. This responsibility is one of the main topics of Section 7. 


6.7 





Sub-conclusions 


The decision-making processes related to the use of Ukraine's airspace was 
dominated by the interests of military aviation. The initiative to restrict the 
airsoace over the eastern part of Ukraine below FL260 originated from the 
military authorities. The objective of the measure was to protect military 
aeroplanes from attacks from the ground and to separate military air traffic from 
civil aviation. The Ukrainian authorities assumed that by taking this measure, civil 
aeroplanes flying over the area above FL260 were automatically sate too. 


The initiative to change the restriction to FL320 on 14 July 2014 came from civil 
air traffic control. The underlying reason for this change remains unclear. 


The NOTAMs did not contain any substantive reason for the altitude restrictions. 
Therefore, Ukraine did not act in accordance with the guidelines in ICAO Doc 
9554-AN/932. 


When implementing the above measures, the Ukrainian authorities took insufficient 
notice of the possibility of a civil aeroplane at cruising altitude being tired upon. 
This was also the case, when, according to the Ukrainian authorities, the shooting- 
down of an Antonov An-26 on 14 July 2014 and that of a Sukhoi Su-25 on 16 July 
2014 occurred while these aeroplanes were flying at altitudes beyond the effective 
range of MANPADS. The weapon systems mentioned by the Ukrainian authorities 
in relation to the shooting down of these aircraft can pose a risk to civil aeroplanes, 
because they are capable of reaching their cruising altitude. However, no measures 
were taken to protect civil aeroplanes against these weapon systems. 


In the international system of responsibilities, the sovereign state bears sole 
responsibility for the safety of the airspace. The fundamental principle of 
sovereignty can give rise to vulnerability when states are faced with armed 
conflicts on their territory and in their airspace. 
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Contents 


6. Such states rarely close their airsoace or provide aeronautical information with et 
specific information or warnings about the conflict. In some cases, other states 
issue restrictions or prohibit their operators and pilots from using the airspace STAY 
above these conflict areas. 


7. There is a lack of effective incentives to encourage sovereign states faced with 
armed conflicts to assume their responsibility for the safety of their airspace. 
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7.1 Introduction 


Operators, as users of the airspace, bear responsibility for safe flight operations." '°? In 
the case of MH17, the operator was Malaysia Airlines. This Section provides a 
reconstruction of the flight preparations and flight operations of flight MH17 on 17 July 
2014. This is followed by a description of Malaysia Airlines’ decision-making process 
related to flying over conflict areas: how was it organised and how was the system applied 
in the case of flight MH17? What information did Malaysia Airlines possess about the 
security situation in the eastern part of Ukraine, how were potential risks assessed and 
what constituted the basis for the decision to fly over the eastern part of Ukraine on 
17 July 2014? Finally, the decisions made by other states and operators related to flying 
over the eastern part of Ukraine will be described. 


Malaysia Airlines 


Malaysia Airlines is Malaysia’s national operator. Since 2013, Malaysia Airlines has 
been an alliance partner in oneworld, along with operators such as American 
Airlines, British Airways, Qantas, Cathay Pacific and Japan Airlines. During the period 
prior to 17 July 2014, the operator flew 91 civil aeroplanes and six cargo aeroplanes 
to 60 destinations (code share flights not included). Kuala Lumpur International 
Airport, the home base of Malaysia Airlines, is a major hub for flights between 
Europe and Asia and on to Oceania. 


7.2 Flight MH17 


As described in Section 2.1 (part A), flight MH17 took off at 10.31'°° from Amsterdam 
Airport Schiphol for a scheduled flight to Kuala Lumpur International Airport in Malaysia. 
Malaysia Airlines (MAS) had submitted a flight plan for this flight at 07.07, which 
established, among other things, MH17's route: the air navigation waypoints, airways and 
altitudes at which MH17 would fly. In Appendix C an explanation of this flight plan of 
flight MH17 and flight plans in general is provided. 


151 This is established, for example, in Annexes 17 (Security) and 19 (Safety Management) to the Chicago Convention 
(see ICAO HLSC/15-WP/3). 

152 National authorities are responsible for certification and the continuous monitoring of airlines based in their States. 

153 All times mentioned in this report are in UTC unless specified otherwise. See the list of abbreviations for a further 
explanation. 
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MH17 flight plan with air navigation waypoints, airways, altitudes and speeds 


-EHAM1000 

-NO490F310 ARNEM UL620 SUVOX UZ713 OSN UL980 MOBSA DCT POVEL DCT 
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-WMKK1137 WMSA WMKP law 
2 Factual 
information 


All air traffic control centres involved accepted MH17’s flight plan for the route in their 
regions. The planned route ran from the Netherlands to Germany, Poland, Ukraine, the 
Russian Federation, Kazakhstan, Turkmenistan, Uzbekistan, Afghanistan, Pakistan, India, 
Myanmar and Thailand to Kuala Lumpur. Malaysia Airlines’ head office in Kuala Lumpur 
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Figure 84: Diagram of the route planned. (Source: Google, INEGI) 


According to the flight plan, flight MH17 would fly at flight level 330 (FL330, circa es 
10,058 metres) above Ukraine to the PEKIT navigation waypoint, which lies on the 9 Assessing the 
boundary of the flight information region (FIR) between the Kyiv FIR (UKBV) and the we 
Dnipropetrovsk FIR (UKDV). From the PEKIT navigation waypoint, the flight plan specified 
FL350 (circa 10,668 metres high) for the remaining part of the flight above Ukraine. 


As established in Section 2.1 (part A), the aeroplane entered the Dnipropetrovsk FIR at 


FL330 instead of the planned FL350. - 
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Figure 85: Image of the Dnipropetrovsk FIR (UKDV), CTA 1 and 4, and the flown (black line) and intended 
(dotted black line) route of flight MH17. The yellow line represents the centre of airway L980. 
(Source: UkSATSE and Google, Landstat) 


The data supplied by EUROCONTROL reveal that Malaysia Airlines was flying through 
Ukraine’s airspace several times a day, also through the Dnipropetrovsk FIR (UKDV). On 
17 July 2014, seven Malaysia Airlines flights flew through UKDV, two from Kuala Lumpur 
to London, one flight from Kuala Lumpur to Amsterdam, two flights from London to Kuala 
Lumpur, one flight from Paris to Kuala Lumpur and one flight from Amsterdam to Kuala 
Lumpur. 


7.3. Code sharing with KLM 


Flight MH17 was a daily flight, operated by Malaysia Airlines, from Amsterdam Airport 
Schiphol to Kuala Lumpur International Airport. It was a very popular flight. This was due 
to the transit options and the favourable time of departure from Schiphol: this slot was a 
good connection for incoming flights from the United States and would arrive in Kuala 
Lumpur early in the morning. KLM also runs a daily flight between Amsterdam and Kuala 
Lumpur. A code share agreement between Malaysia Airlines and KLM applies to both 
flights. 


In the case of flight MH17 on 17 July 2014, eleven passengers had booked their ticket 
with KLM and 269 passengers with Malaysia Airlines. There were also two passengers 
with a Qantas ticket and one with a ticket from Garuda Indonesia.'** The passengers with 
a KLM ticket travelled in accordance with the code share agreement with Malaysia 
Airlines. The passengers who booked via Qantas and Garuda Indonesia travelled on a 
combined flight, which was operated partly by these operators and partly by Malaysia 
Airlines (transfers). 


154 See Dutch Safety Board report MH17 - Passenger information. 
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The code share agreement between Malaysia Airlines and KLM entered into force on 
1 July 1998. The partners renew this agreement every three years. Prior to each season 
(summer-winter), they adjust the timetable in the appendix to the agreement. The 
agreement does not specify any details related to the routes to be flown (with the 
exception of departure and destination locations). However, the agreement does 
establish that the partners exchange ‘safety’ and ‘security’ information and that they 
provide each other with technical and material support in the area of ‘safety’ and 
‘security’. There is no specific reference to the flight route. The Dutch government issued 
its required approval for this agreement. 


The code share agreement between Malaysia Airlines and KLM requires that Malaysia 
Airlines treats code share passengers the same as its own passengers in terms of 
handling, on-board service and claims, and vice versa. The responsibility for satety and 
security is fully borne by the operator operating the flight, in this case Malaysia Airlines. 
In accordance with the agreement, KLM played no part in flight preparations or 
operations. For their code share agreement, KLM and Malaysia Airlines used the IOSA 
audit described in Appendix O to assure themselves that they adhered to equivalent 
safety standards. 


7.4 Flight preparation at Malaysia Airlines 


For this investigation, the Dutch Safety Board conducted interviews with officials from 
Malaysia Airlines. The Dutch Safety Board requested and received various documents 
from Malaysia Airlines. Request by the Dutch Safety Board to interview officials of the 
Malaysian civil aviation authority (the Department of Civil Aviation, DCA) were not 
granted. Requests for relevant documentation were also not accepted by the DCA. 
Nevertheless, the Dutch Safety Board believes it has sufficient information to compile an 
overview of the flight preparations performed by Malaysia Airlines. 


This Section describes the distribution of tasks related to the safety assessment of flight 
routes at Malaysia Airlines. This involves producing threat analyses, planning routes and 
the procedure for compiling a flight plan. 


7.4.1 Security 

In the Security Department, analysts focus on the security of flight operations. The 
primary task of the head of this department is to provide updates and advise Malaysia 
Airlines’ CEO on what is required for the safety of the operations. This involves matters 
such as security at departure and arrival at aerodromes, passengers, baggage, cargo, 
staff (during the flight and on location) and the aeroplane itself. This department assesses 
the situation on the ground, and not in the airspace. Malaysia Airlines does not fly to 
destinations in Ukraine and therefore does not perform any risk analyses related to 
(destinations in) this state. 


The Security Department is not responsible for studying aeronautical information such as 
NOTAMs and threats to foreign airspace. Malaysia Airlines bases its approach on 
Annex 17 to the Chicago Convention and on national provisions issued by the Malaysian 
Department of Civil Aviation (DCA) and by Malaysia Airlines itself. 
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Additional activities are only carried out if Malaysia Airlines is considering flying to a new 
destination. Well in advance of 17 July 2014, the operator received a request from its 
government to fly a charter flight to Yemen, to evacuate a group of Malaysian citizens. 
The head of the Security Department arranged for the situation to be assessed on 
location, and in a consultation with the CEO, the charter department and Flight 
Operations advised that the flight should not be conducted. This was because the 
situation was not considered safe on the ground at the destination location. 


In order to determine the security situation in a state, Malaysia Airlines’ Security 
Department occasionally receives intelligence from Malaysian embassies and High 
Commissioners (equivalent of Ambassadors in Commonwealth states). In addition, public 
sources are consulted, such as newspapers and television and local stations that report 
on worldwide events. Local police sources are also used. Malaysia Airlines receives daily 
security recommendations from a private service provider about to the various ground 
stations. Information is also shared among the Association of Asia Pacific Airlines (AAPA). 


Malaysia Airlines '°° has stated in interviews that it did not receive any security information 
about foreign states from the Malaysian authorities. The explanation for this was that the 
Malaysian authorities only collect information related to its interior. The Dutch Safety 
Board has not been able to verify this information with the Malaysian authorities because 
they did not answer questions about this. As a result, it is not possible to establish the 
extent to which the Malaysian intelligence services possessed information about the 
situation in the eastern part of Ukraine. 


7.4.2 Route planning 

At Malaysia Airlines, the Flight Operations (Flight Ops) Department is responsible for 
flight operations as a whole, including safety, flight execution in accordance with the 
statutory rules and the efficiency of flight operations. To fulfil this responsibility, Flight 
Ops uses different information sources; Aeronautical Information Publications (AIPs), 
Aeronautical Information Circulars (AlCs), NOTAMs (Notice to Airmen), EASA bulletins, 
information from the air traffic service centres of states whose airspace will be used and 
EUROCONTROL. An employee trom the department assesses the details supplied in the 
NOTAMSs as an additional verification step. The department also monitors media reports, 
but these can be seen as potentially too superficial and speculative. Therefore, Flight Ops 
depends upon the NOTAMSs as official and primary sources of information to use in flight 
planning. Flight Ops relies on the flight plan system (Sabre), which searches for relevant 
NOTAMs via the OPUS system and automatically verifies whether these constitute any 
restrictions to the planned flight. Compiling an inventory of and interpreting threat 
information is not one of the duties of the Flight Operations department. 


If Malaysia Airlines decides to use a new route, Flight Ops examines matters such as the 
applicable rules in the state concerned (communicated via AlIPs), restrictions (such as 
minimum flight altitudes) and agreements (such as overflight permits), distances, 
operational requirements (such as deviation aerodromes) and general weather conditions 
(wind direction/speed), and determines the most efficient route on this basis. 





155 A representative from the Department of Civil Aviation (DCA) was present at these discussions as an observer. 
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An operator may have several routes for a single destination and selects one based on 
the aforementioned considerations. For the flight from Amsterdam to Kuala Lumpur, 
prior to 17 July 2014 Malaysia Airlines had a choice of four routes:'°° 


e Via Ukraine and the Rostov zone in the Russian Federation (the most efficient of the 
four routes, which was also the one actually useq); 

e Via Iraq; 

e Via Iran; 

e Via Saudi Arabia. 


7.4.3 Flight plans 

Once the routes have been established, a flight plan is compiled per flight. The flight 
plan is compiled by the Navigation and ATM Planning Team of the Flight Dispatch 
Department. The Operational Control Centre (OCC) is concerned with operational risk 
analyses (wind, tuel consumption etc.) and is purely an executive body. If there are no 
special reports, the OCC’s work follows the usual routine. The department assesses 
routes daily, based on the current situation. Specific conditions (weather, temporary 
airspace closures, etc.) may necessitate a deviation from the optimal route. 


The Flight Dispatch Department handles 385 flights per day. They do so in 
accordance with a fixed procedure: 


e Malaysia Airlines uses an electronic system that compiles and verifies flight plans. 
The department assesses whether the proposed route conflicts with any 
procedures or temporary restrictions specified in the NOTAMs from states along 
the route. 

e The route is verified using legal provisions issued by the relevant states. 

e Six hours prior to the flight's take-off, Flight Dispatch at Malaysia Airlines verities 
whether the flight plan can be executed, taking into account the current weather 
situation and the aircraft's technical condition and load. 

e Three hours before the flight's departure, Flight Dispatch at Malaysia Airlines 
submits the flight plan electronically to EUROCONTROL (for flights trough 
European air space) and to all states whose airspace will be used. This is done to 
obtain advance approval and permission from EUROCONTROL and each of the 
respective states whose airspace will be used beyond Europe. 

e Shortly before the flight’s departure, Malaysia Airlines’ ground handler at the 
departure aerodrome provides the pilot-in-command with all the flight 
documentation, including the NOTAMs, flight plan and weather data received 
from Malaysia by e-mail. 

e Lastly, the flight crew also assesses the NOTAMs. 





156 At the time of writing (April 2015) just one route was available: via Iran, south of Ukraine. The additional costs 
involved in using this route amount to approximately EUR 3.75 million (MYR 15 million) per month (price level of 
January 2015). Malaysia Airlines says that it no longer flies over Afghanistan or Iraq, due to military activities on the 
ground and a lack of clarification regarding the situation there. 
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When a Malaysia Airlines flight departs from a foreign aerodrome, the Flight Dispatch 
Department sends a briefing package to the station manager or ground handler in the 
state of departure. The latter’s most important task is to ensure that the pilot-in-command 
receives the brieting package in consultation with the ground handling service. 


To summarise: Malaysia Airlines assesses the safety of the flight in the flight phase based 
on aeronautical information. The Security Department only assesses the situation on the 
ground (departure and arrival location, aircraft, crew, baggage, passengers etc.). 


7.5 The risk assessment performed by Malaysia Airlines prior to flight MH17 


Following the crash on 17 July 2014, the question was raised why operators were flying over 
the eastern part of Ukraine while an armed conflict was taking place there. This Section 
describes what information Malaysia Airlines possessed about the security situation in the 
eastern part of Ukraine, how this operator assessed potential risks and what constituted the 
basis for the decision to fly over the eastern part of Ukraine on 17 July 2014. 


7.5.1 Aeronautical information 

In July 2014, tour relevant NOTAMs’’ were in force in the airspace in the Dnipropetrovsk 
FIR (UKDV).'°° The airspace in the eastern part of Ukraine was open above FL260 and 
later above FL320. Malaysia Airlines automatically processed these NOTAMsS via the flight 
plan system used for this purpose. All the cited NOTAMs were included in the briefing 
package for flight MH17. For Malaysia Airlines, these NOTAMs did not constitute any 
basis for not operating the flight through Ukraine’s airspace. 


Malaysia Airlines was aware of the ICAO State Letter published on 2 April 2014 about the 
Simferopol FIR,'°’ which informed Member States about the potential risks to the safety of 
civil flights in the Simferopol FIR (Crimea) due to two air traffic control centres claiming the 
same region. The same applies to EASA’s subsequent Safety Information Bulletin (SIB), 
which confirmed the warning issued by ICAO. But since Malaysia Airlines did not operate 
any flights over Crimea, this safety warning had no effect on Malaysia Airlines’ operations. 
Therefore, the decision to shift the route to the north or south of Crimea did not apply. 


Malaysia Airlines says it was not aware of SFAR 113, issued by the U.S. aviation authority 
(Federal Aviation Administration, FAA), dated 23 April 2014. In this safety warning, the 
FAA prohibitted U.S. operators and airmen trom flying over Crimea. Because Malaysia 
Airlines no longer flies over the United States, the operator has ceased monitoring the 
SFARs issued by the FAA. They also viewed them as a U.S. matter because, for example, 
U.S. operators have a risk profile that differs from that of Malaysia Airlines. The NOTAM 





157 This involves the following NOTAMs issued by Ukraine: A1383/14, A1384/14, A1492/14, A1493/14. 
158 See Section 5.3. 
159 EUR/NAT 14-0243.TEC (FOL/CUP). 
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that referred to the SFAR in question ‘°° was also not included in the briefing package 
that Malaysia Airlines had compiled for MH17’'s flight route, because this particular flight 
did not take-off from or land in the United States or pass through the latter’s airspace."°' 


During the period between 23 April and 17 July 2014, foreign or international parties did 
not issue any NOTAMs or other formal information communication about the eastern 
part of Ukraine. Malaysia Airlines says that, in the months leading up to 17 July, it did not 
receive any warnings related to the situation in the eastern part of Ukraine from other 
parties either, including the Malaysian authorities and intelligence services. 


The brieting package for flight MH17 also included two NOTAMS related to the Rostov 
FIR, which the Russian Federation published on 16 July 2014 and became effective from 
17 July 2014. These NOTAMs, which stated that the use of a number of flight routes on 
the Russian side of the border with Ukraine were subject to altitude restrictions, included 
a reference to the armed conflict in the eastern part of Ukraine as the reason for the 
flight restriction. The information provided in these NOTAMs was, however, not clear-cut: 
in addition to the altitude restriction, which was effectively the same as the restriction in 
force in the neighbouring Ukrainian UKDV FIR, it included a second flight restriction: the 
airspace was restricted below FL530 (see Section 5.2). The automatic filter applied by the 
automated flight plan system used by Malaysia Airlines accepted the NOTAM despite 
this contradiction, and this did not lead to a route change. Whether the reference to the 
armed conflict was picked up by Malaysia Airlines is unknown, but in any case the route 
was not changed. 


7.5.2 Media reports 

During the period between the conflict breaking out in the eastern part of Ukraine in 
April 2014 and the day of the crash of flight MH17 on 17 July 2014, various reports 
appeared in the media regarding aircraft of the Ukrainian armed forces being shot down 
(see Section 5). The Ukrainian authorities have contirmed some of these incidents (see 
Section 5.3) The Dutch Safety Board asked Malaysia Airlines which of these signals 
reached the operator. 


Malaysia Airlines was aware that the situation in the eastern part of Ukraine was unstable 
and that a conflict was taking place on the ground. The operator did not consider this as a 
reason for monitoring the area more closely, especially given the fact that it did not fly to 
any Ukrainian destinations. Since Ukraine's airspace restrictions had no impact on the flight's 
planning, Malaysia Airlines saw no reason to consciously reflect on the satety of this route. 
The operator stated that it did not pick up any signals in the media that indicated a threat. 


Prior to 17 July 2014, Malaysia Airlines was not aware that, according to the Ukrainian 
authorities, on 14 July 2014 an Antonov An-26 flying above the eastern part of Ukraine was 
downed at an altitude of 6,500 metres with a weapons system that could reach cruising 
altitude (see Section 5). Prior to 17 July, the operator possessed no information that there 
could be medium or long-range surface-to-air missiles or air-to-air missiles in the area. 





160 NOTAM FDC 4/7667. Valid from 23 April 2014 through 27 April 2015. 
161 Another reason for this is that Malaysia Airlines is not a U.S. operator. For U.S. operators, an SFAR is a ‘regulation’, 
regardless of whether or not the flight passes through U.S. airspace. 
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7.5.3 Other information 

As described in Section 7.4, Malaysia Airlines explained that the operator did not receive 
any threat-related information from its national authorities about foreign states. In other 
words, prior to 17 July 2014, its authorities did not represent a source of information 
related to the safety of the airspace above the eastern part of Ukraine. 


Malaysia Airlines is a member of the Association of Asia Pacific Airlines (AAPA), an interest 
organisation for international operators in the Asia-Pacific region. Within AAPA, Malaysia 
Airlines is also a member of the Security Group in which operators exchange security 
information about security on the ground, and the Flight Ops Consultation, which is 
concerned with various matters including flight routes. Malaysia Airlines did not receive 
any signals via this network about the deteriorating safety situation in the eastern part of 
Ukraine. 


In April 2014, Malaysia Airlines received signals from other operators that the satellite 
communication (SatCom), and possibly also GPS, may be disrupted in Ukraine's airspace. 
Malaysia Airlines warned its pilots and asked them to be vigilant in this respect and 
directly report any irregularities encountered. However, the operator did not view this as 
a major risk to the navigation capability because the navigation beacons on the ground 
were still operational. After a while no such disruptions to equipment had been reported. 


Prior to 17 July 2014, Malaysia Airlines did not contact other operators with regard to the 
situation in the eastern part of Ukraine, including the operators that had changed their 
flight route(s). In interviews with the Dutch Safety Board, Malaysia Airlines stated that 
operators continuously alter their routes, for various reasons. For example, because - unlike 
Malaysia Airlines - they do have authorisation to fly over a particular country, or because 
they have inserted a stopover in their route. Malaysia Airlines expects that other operators 
would have made contact if the airspace had not been safe. Malaysia Airlines stated that, 
if it altered a route for safety reasons, it would communicate the fact to its alliance 
partners. In the case of the eastern part of Ukraine, other operators, including its alliance 
partners, did not share any safety information with Malaysia Airlines. As many operators 
were flying there, there was no reason for Malaysia Airlines to doubt the safety of the 
airspace. 


When planning a route, operators must also take unexpected scenarios into account. 
One example is a disruption to normal flight operations such as engine failure resulting in 
a drift down.'°* When determining the flight plan, the operator must select the route in 
such a way that, in case of such an event, the aircraft can always meet the minimum 
altitude above ground, especially in mountainous terrain. Specifically in this case, the risk 
of an aircraft descending to below FL320 (and earlier FL260) due to a drift down was 
considered as very unlikely. Malaysia Airlines is confident that the pilots are trained in the 
procedure for this type of situation and that they will receive assistance from air traffic 
control enabling them to reach a safe area. 





162 Drift down is the situation in which an aeroplane, with one malfunctioning engine, is forced to descend from 
cruising altitude to the altitude at which the aeroplane can continue to fly on the remaining engine with the 
maximum permitted engine capacity. 
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7.6 | What did ICAO and other states do? 


Following the crash involving Malaysia Airlines flight MH17, the question was raised what 
other states did and did not do with regard to the use of the airspace above the eastern 
part of Ukraine, in relation to the intelligence they had. 


Therefore, it was investigated how ICAO and other states acted and what options were 
available to them. To obtain information on this subject, the Dutch Safety Board 
predominantly used surveys and interviews, with or without the assistance of its foreign 
sister organisations. The examples cited in this Section are not exhaustive, but serve 
purely to put Malaysia Airlines’ decision into perspective. The key question is: did ICAO 
and other authorities perceive any risks related to flying over the eastern part of Ukraine 
during the period leading up to 17 July 2014? 


7.6.1. ICAO 

After the first State Letter on 2 April, ICAO did not distribute another State Letter about 
the potential threats in the Simferopol FIR. In answer to the Dutch Safety Board’s questions, 
ICAO stated that it did not receive any additional information that justified issuing a new 
State Letter. ICAO did not issue any State Letters about the eastern part of Ukraine during 
this period. The statement made by the Ukrainian authorities with regard to the 
Antonov An-26 being shot down on 14 July, which referred to weapon systems that can 
reach cruising altitude, did not constitute a reason for ICAO to issue a State Letter either. 


ICAO stated that it did not receive any request for advice from Ukraine pertaining to the 
possibility of taking safety measures. With regard to the possibility of assisting a state in 
the event of an armed conflict, ICAO Doc 9554-AN/932, paragraph 10.10 says: ‘ICAO 
may assist in the development, co-ordination and implementation of necessary safety 
measures in the event that the State(s) responsible for the provision of air traffic services 
in an area of armed conflict cannot, for some reason, adequately discharge the 
responsibility referred to in 10.2 above. The specific nature and scope of such action will 
depend upon the particular circumstances involved. In such circumstances, ICAO will 
work in close co-ordination with the responsible State, with other provider and user States 
concerned, and with IATA and IFALPA.' 


In response to the questions submitted by the Dutch Safety Board, ICAO stated that the 
organisation has no mandate to actively intervene in the decision-making by states with 
regard to closing their airspace. ICAO can only notify the state in question if the former 
has received information about potential threats. ICAO stated that it has neither a 
mandate nor the facilities to investigate all risks present in states. 


7.6.2 States’ interpretation of their role 

The investigation into airspace management above conflict areas revealed that indications 
that could point to risks to civil aviation arising from armed conflicts, often originate from 
third parties. Despite the international character of civil aviation, there are major 
differences in the role of national authorities with respect to flying over conflict areas (see 
also Appendix U). Before addressing the question of what other states did with regard to 
the eastern part of Ukraine, it is necessary to examine these differences. 
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The international framework provides room for states to assume less or more responsibility 
with regard to decisions regarding flight routes. The more limited the state’s role is, the 
more operators must do themselves to get an impression of conflict areas and the risks 
they present to civil aviation. However, gathering intelligence about what precisely is 
going on in conflict areas is difficult. Operators have fewer possibilities to do so than 
states, which can rely on their diplomatic and intelligence services in this matter. If the 
authorities are totally uninvolved, there is the chance that the information position of the 
operators based in the relevant state will be too limited to enable them to perform an 
adequate risk assessment of conflict areas. 


On the basis of information provided by Malaysia Airlines, the Dutch Safety Board 
concludes that the Malaysian authorities did not consider that they had any role to play in 
identifying and managing risks in foreign airspace. In their intelligence activities, the 
national authorities focus on national security. This does include the security of 
aerodromes located in the state, but not the safety of civil aviation in foreign airspace. 
When it came to further assessing foreign airspace, Malaysia Airlines had to rely on other 
sources than the Malaysian authorities. 


In certain states, the authorities can prohibit operators and airmen based in that state 
from flying to specific destinations or from using a particular state’s airspace (or part 
thereof). In this case, the aviation authorities produce their own threat and risk analyses if 
they feel this is necessary. 


In the United States, the Federal Aviation Administration (FAA) can issue a flight 
prohibition or warning.'°? The Department for Transport (DfT) in the United Kingdom can 
also issue a flight prohibition, pursuant to on the Aviation Security Act of 1982 (see 
Appendix U for details). In practice, the DfT mainly focuses on performing risk analyses 
and advising and possibly warning operators. This requires an extensive intelligence 
position in all states that could present a risk to civil aviation. In April and July 2015 
Germany announced flight prohibitions for the airspace of Libya and Yemen.'°** '® For 
many states, this is not standard practice and simply not feasible. 


Between these two extremes, there are states that go no further than (informally) 
providing operators with information and states that issue recommendations to operators 
based in their territory.'°° States can share relevant safety information with those 
operators about foreign airspace and armed conflicts, so that the operators can use the 
information in their risk assessment. Moreover, states can share relevant information with 
the international aviation sector, for example through NOTAMs. 


Lastly, there are states that go beyond sharing information. The authorities in these states 
also produce aviation-specific risk analyses and provide their operators with these or 
issue advice based on the analyses. France is an example of one such states. The 


163 Foran explanation of ‘SFAR’, see Section 12, Abbreviations and Definitions. 

164 http://www.bmvi.de/SharedDocs/DE/Artikel/LR/verbot-luftraum-jemen.html. consulted on 19 August 2015. 

165 http://webcache.googleusercontent.com/search?q=cache:1NMIJfXoT0sJ:m.omvi.de/SharedDocs/DE/Artikel/LR/ 
verbot-luftraum-libyen.html%3Fnn%3D62482+andcd=1andhl=nlandct=clnkandgl=n 

166 This often involves information that has been obtained as supplementary to other activities. 
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authorities advise, issue formal recommendations and warnings, which can be urgent or 
not. The formal requests are applicable to the French operators. Therein the authorities 
actively participate in the decision-making about flying over conflict areas, while the final 
responsibility remains with the operators. 


7.6.3 What did other states do? 

As described in Section 5, on 4 March 2014, the U.S. aviation authority (FAA) issued a 
NOTAM that contained a general warning to U.S. operators and airmen flying in Ukraine's 
airspace pertaining to potential instability and an increasing military presence in the 
airspace. On 3 April 2014, the FAA issued a prohibition on U.S. operators and airmen 
flying in Crimea’s airspace (Simferopol FIR). In NOTAM 4/2816, the operators were also 
warned to exercise extreme caution with regard to flying in other parts of Ukraine, due to 
the persistent risk of instability. On 23 April, this warning, which also referred to, but was 
not limited to, the eastern part of Ukraine, was repeated in a NOTAM. Both NOTAMs 
made no reference to military activities. After these NOTAMs, and before 17 July 2014, 
the FAA did not issue any other warnings or prohibitions related to flying in the area 
above the eastern part of Ukraine. 


On 30 June, the authorities in the United Kingdom issued a recommendation to avoid 
the airspace above Crimea,'®’ but did not issue any further warnings related to flying over 
the eastern part of Ukraine. 


The ‘scope’ of the general warnings about Ukraine was limited (see the explanation in 
the text box below). This was also demonstrated by the risk assessment performed by 
Malaysia Airlines which, while basing its threat analysis on aeronautical information, did 
not actively monitor U.S. NOTAMs and SFARs because the operator no longer flew over 
or to the United States. 


The visibility of NOTAMs 


If a state issues a NOTAM about an other state, the NOTAM only appears in the 
selection of NOTAMs that are relevant to a flight, if the flight is passing through the 
state that issued it. This means that a NOTAM issued by the United Kingdom about 
an other state (such as Ukraine) is only visible to operators that take off from, land in 
or fly through the airspace of the United Kingdom. NOTAMs issued by a state about 
its own territory always appear in the selection of NOTAMs if a flight passes through 
the FIR concerned, in this case the UKDV FIR (Dnipropetrovsk FIR). 


In summary: insofar as the Dutch Safety Board was able to ascertain, between the 
beginning of March and 17 July 2014, one warning was published about the safety of the 
airspace in Ukraine in relation to military activities. The United States warned of potential 
instability, an increasing military presence and possible confrontation with military 


167  NOTAM EGTT B1258/14, dated 30 June 2014. This NOTAM does not contain any new information compared with 
earlier publications by ICAO and the FAA in April. 
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activities in the airspace. The NOTAM that included this warning was only valid and 
visible in March 2014. Between the end of April and 17 July 2014, no formal warnings 
were issued about the safety of the airspace in Ukraine, including the eastern part of 
Ukraine. It was precisely during this period that the armed conflict expanded into the 
airspace. 


7.7. What did other operators do? ‘°° 


This Section describes how other operators reacted to the changing situation in Ukraine. 
Here, only international flights that passed through Ukraine’s airspace are included, as flight 
MH17 did, and not domestic flights or flights that operators operated from or to Ukraine. 


Data that the Dutch Safety Board received from EUROCONTROL reveal that, during the 
period between April and 17 July 2014, no noticeable reaction was observed from 
operators with regard to the situation in Ukraine; a large number of operators continued 
to use routes over the eastern part of Ukraine. EVUROCONTROL data were used to 
compile several lists (see also Appendix R). The first is a list of all the flights that flew over 
the entire region of the eastern part of Ukraine during the months of April, May, June 
and July 2014 (through 17 July 2014). Section 6 already explained that, between April 
through 17 July, an average of 1,300 flights per day were operated throughout all of 
Ukraine. 


The list from EUROCONTROL reveals that the average number of international flights 
that flew through the UKDV region (Dnipropetrovsk FIR) per day did not change after the 
unrest intensified in the eastern part of Ukraine and the armed conflict increasingly 
expanded into the airspace. Even following the Ukrainian NOTAMs'®’ on 6 June, 1 July 
and 14 July 2014, there was no significant change in the number of flights through UKDV; 
on average there were approximately 220 flights per day (see Figure 86). 





168 The information about the way in which airlines reacted to the situation in Ukraine was mainly obtained through 
surveys and using data supplied by EUROCONTROL. 

169 NOTAMs A1255/14, A1256/14, A1383/14, A1384/14 - the restriction below FL260 from 6 June 2014 and NOTAMs 
A1492/14 and A1493/14 - the restriction below FL320 on 14 July 2014. 
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Figure 86: Daily number of flights through UKDV shown for the period between 1 April - 17 July 2014. (Source: 
EUROCONTROL) 


A minor shift can be observed in the distribution of the number of daily flights in the 
airspace above the area within UKDV mentioned in the NOTAMs and the flights operated 
just south of this area (see Figure 87). In April 2014, an average of 152 flights were 
operated per day in the airspace above the part of UKDV to which the NOTAM refers; in 
June, the average was 147 and in July it was 145 per day. In the same period, there was a 
slight increase in the number of flights south of the NOTAM area, where the altitude 
restrictions did not apply; these amounted to 68, 76 and 79 respectively per day. 


The Dutch Safety Board used the flight data supplied by EUROCONTROL to produce a 
list of all operators that flew over the NOTAM area between 14 and 17 July (i.e., the 
period between the publication of the NOTAM that restricted the airspace up to FL320 
and the crash of flight MH17). The Dutch Safety Board also produced a list of all flights 
that passed UKDV on 17 July (the day flight MH17 crashed) until the airspace was closed 
at 15.00. There were 160 flights. Both lists are included in Appendix R. 


All the lists reveal that there is no noticeable change in behaviour; in the period between 
14 and 17 July 2014, 61 operators from 32 states flew over the area. These also included 
operators from Ukraine itself and the Russian Federation. 


The following points must be taken into account when assessing the data supplied by 
EUROCONTROL: 


e The data were automatically generated by EUROCONTROL. No verification of the 
data’s accuracy was performed. 

e These are the operators whose flight numbers are used to identify the flights and to 
which the overflight fees are charged. This is not necessarily the operator that actually 
operated the flight. 
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Figure 87: Flight routes through the eastern part of Ukraine with cited the area referred to in the NOTAMs in 
Section 6 indicated by a red line. The routes outside the NOTAM area (i.e. south of it) but inside 
UKDV are shown in purple. (Source: Dutch Safety Board) 


The Dutch Safety Board also conducted a survey to try to obtain a better understanding of 
operators’ motives for deciding whether or not to fly over the eastern part of Ukraine. 
Nineteen operators from eight states participated in the survey. Four operators stated that 
they had never flown over the eastern part of Ukraine and one operator already stopped 
flying over Ukraine in 2011. Six of the surveyed operators flew over the eastern part of 
Ukraine until MH17 crashed on 17 July 2014. In April, one of these six operators decided to 
no longer fly over Crimea but did continue to fly over the eastern part of Ukraine. Eight 
other operators already stopped flying over the eastern part of Ukraine in March and April 
2014, stating that it was due to the uncertainty of the situation in the Simferopol FIR 
(Crimea), with regard to which they were also warned by various aviation authorities. 


The Dutch Safety Board also obtained information about the reason behind the decision 


whether or not to fly there, from interviews with and observations of operators. In one of 
these interviews, one of the operators stated that the security department constantly 


a = y 4 223 01 277 















Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 
7 Flying over 
Ukraine 


Part B: 
9 Assessing the 
aL « 


ai 
Recommendations 


13 


List of appendices 


monitored the situation in Ukraine in the months leading up to the crash of flight MH17, but 
that the focus was on the situation in and around Kyiv, because it was a landing location. 
The operator deemed the situation in the eastern part of Ukraine to be non-threatening, 
because it assumed that the fighting parties did not consider civil aircraft to be targets. 


Another operator stated that it stopped flying over Ukraine as a whole in March, because 
it did not consider the situation throughout Ukraine to be adequately safe as a result of 
the developments in Crimea. This operator did continue to monitor the developments 
and after the Antonov An-26 was shot down on 14 July 2014, concluded that it had made 
the right decision, since the aircraft had to have been shot down with a more powertul 
weapon than a MANPADS. 


The investigation also revealed that two U.S. operators were no longer flying over the 
eastern part of Ukraine as of 14 and 15 July, for practical reasons. When questioned, it 
turned out that one of the two operators had not planned any flights over the eastern 
part of Ukraine during the period between 14 and 17 July 2014. The other operators 
reported that the decision was the result of the NOTAM with the FL320 altitude restriction 
that was issued after the Antonov An-26 had been shot down. This operator indicated 
that it was quicker for it to select a different route than to implement the new altitude 
restriction in its flight plan program. The new NOTAM was therefore the immediate 
reason for this operator to alter the route and not potential information related to the 
armed conflict and possible dangers it posed to overflying civil aeroplanes. For that 
matter, other U.S. operators did not alter their route and continued to fly over the eastern 
part of Ukraine. 


7.8 Analysis: what did Malaysia Airlines do and what did others do? 


7.8.1 Malaysia Airlines and other operators 

Malaysia Airlines operates according to the requirements for Security and Flight 
Operations as established in |CAO’s international standards and recommended practices. 
Malaysia Airlines knew that there was an armed conflict on the ground in the eastern part 
of Ukraine, but assumed that the airsoace would be safe based on the official airspace 
status information, as provided by the national aviation authorities and EJROCONTROL. 
Malaysia Airlines stated they did not actively seek information and did not actively 
monitor media reports about the situation in the eastern part of Ukraine. At the same 
time, Malaysia Airlines did not receive any threat-related information from its own 
authorities or from other states, international organisations or other operators. 


Malaysia Airlines was not approached by any other operators, nor did it receive 
information via its alliance network. There was also no exchange of information related to 
the situation in the airspace above the eastern part of Ukraine with KLM, which was the 
code share partner on flight MH17. Since, based on its own risk analyses, KLM saw no 
reason to stop flying over the eastern part of Ukraine, there was no reason for KLM to 
approach Malaysia Airlines regarding any potential risks involved in the route.'”° 





170 See also Section 8. 
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In other words, Malaysia Airlines based its decision virtually exclusively on aeronautical 
information (selection of NOTAMs) and did not perform its own additional risk 
assessment. 


Insofar as the Dutch Safety Board has been able to ascertain, Malaysia Airlines complies 
with all standards relevant to ‘air operators’: the operator has an AOC, through which the 
Malaysian State indicates that the operator complies with ICAO standards and national 
regulations. Malaysia has a security programme, with which the operator fulfils the 
requirements set out in Annex 17 of ICAO. Malaysia Airlines filtered, processed and used 
aeronautical information for preparing and executing the flight. The way in which Malaysia 
Airlines prepared the flight therefore complies with the requirements for Security and 
Flight Operations as defined in |CAO’s international regulations. 


The Dutch Safety Board observes that, insofar as could be determined, Malaysia Airlines 
complied with its legal requirements but did not make any additional efforts to obtain an 
overview of the safety of the airspace above the eastern part of Ukraine. Malaysia Airline’s 
information position related to potential threats in the airspace was limited, in part as a 
result of decisions it made independently and because the operator was not able to 
obtain any intelligence related to foreign airspace from its national authorities. At the 
same time, the question is whether a more effective information position would have led 
to a different decision with regard to the flight route. Malaysia Airlines was not in a unique 
situation: there were many operators that were still flying over the conflict area, including 
operators that did generally seek additional information about conflict areas or operated 
in a context in which their national authorities played a more informative or steering role. 


7.8.2 ICAO 

In the State Letter related to Simferopol FIR (Crimea) on 2 April 2014, ICAO stated they 
would continue to actively coordinate with the parties active in the region with respect to 
the developments in the realm of flight safety. This may have created expectations that 
ICAO would continue to monitor the situation in all of Ukraine. 


However, after issuing the State Letter up and to the crash of flight MH17, the civil aviation 
organisation did not take any additional action with regard to Ukraine. ICAO relies on 
other states for information and stated that it did not receive any information during this 
period that justified publishing a new State Letter. The statement made by the Ukrainian 
authorities related to the Antonov An-26 being shot down on 14 July did not constitute a 
reason for ICAO to take any further action, despite the fact that the statement included 
the possibility of the involvement of a much more powerful type of missile or the 
intervention by a fighter aeroplane. In addition, ICAO did not receive a request for 
assistance from Ukraine (as recommended in ICAO Doc 9554-AN/932), on the basis of 
which ICAO could have played a role. ICAO stated that it actively seeks verification in the 
case of unverified reports about a lack of safety in an airspace, first and foremost from 
the state that manages the relevant airspace. Based on this interpretation of its role, 
ICAO could have offered Ukraine its assistance and, if necessary, could have issued a 
State Letter as a precaution. Doc 9554-AN/932 also does not preclude such an active 
role for ICAO. The Dutch Safety Board does understand ICAO’s point of view that it 
cannot issue a warning or State Letter based on unverified reports or media reports, but 
it is of the opinion that this does not apply to official statements made by the relevant 
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authorities. In the Dutch Safety Board's opinion, it would have been appropriate in this 
regard for ICAO to have requested clarification trom Ukraine and/or offered its services, 
in relation to the statements made by the Ukrainian authorities about the Antonov An-26 
being shot down on 14 July. 


7.8.3 Other states 

Various states collected information about the conflict in the eastern part of Ukraine. 
Although the FAA issued a warning about Ukraine's airspace at the beginning of March 
2014, this was only valid till the end of March and concerned the whole of Ukraine. After 
the end of April 2014, when the conflict in the eastern part of Ukraine expanded into the 
airspace, the risk posed to civil aviation by flying over the area was not recognised by any 
states. States did not issue any specific recommendations related to flying over the 
conflict area. The explanation for this is that states gathered and assessed the information 
from a military-strategic and geopolitical perspective. Western states’ fear of an invasion 
of Ukraine by the Russian Federation and the consequences for stability in Europe and 
the world were paramount. These states did not realise that the conflict could present a 
risk to civil aeroplanes flying over, even when the fighting increasingly expanded into the 
airspace and the Ukrainian authorities reported on weapon systems that can reach 
cruising altitude. 


7.8.4 Other operators 

From the relatively unchanged number of flights across the area above the eastern part 
of Ukraine, the Dutch Safety Board deduces that also operators other than Malaysia 
Airlines did not realise that the armed conflict could pose a risk to civil aviation either. 
The Dutch Safety Board was able to establish that just one operator decided to no longer 
fly over Ukraine for safety reasons. However, this decision was already made in March 
2014 as a result of developments in Crimea. The armed conflict had not yet erupted in 
the eastern part of the country at that time. Evidently, most operators considered that 
there was no reason to assume that civil aviation was in any danger while flying over 
Ukraine at high altitude. 


The investigation highlights the fact that the developments in Crimea were the rationale 
behind eight of the nineteen surveyed operators altering their flight routes and no longer 
operate over the eastern part of Ukraine. This took place a few months before 17 July 2014, 
when there was no or virtually no talk of an armed conflict in the eastern part of Ukraine. 
Some caution has to be applied when drawing conclusions related to the extent to which 
operators altered their flight routes. 


As mentioned above, just one operator stated that the general safety situation in the 
Ukraine was the rationale for the decision. Decisions related to altering routes may also 
arise from other considerations, such as changes in meteorological circumstances, 
changes in destinations or other operational circumstances. This also applies to the small 
increase in the number of operators that flew south of the area described in the NOTAMs 
over the eastern part of the Ukraine. 
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Sub-conclusions 


. As operating carrier, Malaysia Airlines was responsible for the safe operation of 


flight MH17 and therefore for the choice of the flight route on 17 July 2014. The 
way in which Malaysia Airlines prepared and operated the flight complied with 
the applicable regulations. Malaysia Airlines relied on aeronautical information 
and did not perform any additional risk assessment. Malaysia Airlines did not 
receive signals from other operators or via any other channels indicating that the 
airspace above the eastern part of Ukraine was unsafe. 


Malaysia Airlines was also responsible for the safety of the passengers who had 
booked via its code share partner KLM. Since KLM, just like other operators, saw 
no safety reason to avoid the airspace above the eastern part of Ukraine, Malaysia 
Airlines and KLM did not exchange any information about the armed conflict. 


A single operator decided to stop flying over Ukraine because of growing unrest 
in the country. This decision was made in March 2014, i.e. before the armed 
conflict broke out in the eastern part of Ukraine. 


Insofar as the Dutch Safety Board was able to ascertain, no other operators 
changed their flight routes for safety reasons related to the conflict in the eastern 
part of Ukraine after this. This did not change after the Antonov An-26 had been 
shot down on 14 July 2014, which, according to the Ukrainian authorities, had 
been done using a more powerful weapon system than MANPADS. 


Data provided by EUROCONTROL reveal that during the period between 14 up 
to and including 17 July, 61 operators from 32 states used the airspace above the 
eastern part of Ukraine. On 17 July 2014, 160 flights were performed in UKDV 
until the airsoace was closed at 15.00 (17.00 CET). 


. Operators - including Malaysia Airlines - assumed that the unrestricted airspace 


above FL320 over the eastern part of Ukraine was safe. This was despite the fact 
that the conflict was expanding into the air and that, according to the Ukrainian 
authorities, weapon systems were being used that could reach civil aeroplanes at 
cruising altitude. 
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7. When, between the end of April and July, the armed conflict in the eastern part met 


of Ukraine expanded into the airspace, not a single state, for as far as the Dutch 
Safety Board was able to ascertain, explicitly warned its operators and pilots that STE La 
the airspace above the conflict zone was unsafe, nor did they issue a flight 


prohibition. States that did gather information about the conflict in the eastern 
part of Ukraine were focusing on military and geopolitical developments. 
Possible risks to civil aviation went unidentified. 


8. During the period in which the conflict in the eastern part of Ukraine expanded ae 
into the airspace, ICAO did not ask the Ukrainian authorities about airspace cereals 
management and did not offer any assistance. This did not change after the 
statement made by the Ukrainian authorities on 14 July 2014 on the 
Antonov An-26 that had been shot down. 
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8.1 Introduction 


The crash involving flight MH17 on 17 July 2014 raised the question why operators were 
flying over the eastern part of Ukraine when there was an armed conflict in the area. In 
the Netherlands, this was followed by the question whether there was anything the Dutch 
State could have done to prevent the crash.'”' This was because there were 193 Dutch 
citizens on board, because the aeroplane departed from the Netherlands and because 
eleven passengers booked their flight with a Dutch operator (KLM). 


The Dutch Safety Board has investigated the extent to which the state in which an 
international flight takes off must - or can - play a role in the decision-making related to 
flight routes. Firstly, this role concerns flights by operators based in the state in question, 
because the ICAO framework provides states with room to inform, warn or prohibit 
operators based in their territories from crossing certain airspaces. However, citizens 
from these states can also travel with operators that are based in another state. It is 
therefore conceivable that states, out of concern for their citizens, share information 
related to threats with all operators that operate flights from these states. In this Section, 
the situation in the Netherlands was chosen as a starting point because the Netherlands 
was the state of departure for flight MH17. The Dutch Safety Board is of the opinion, 
however, that other states can also draw lessons from the findings. 


Specific research questions for this Section are: 


e What role did the Dutch State play in the decision-making process with regard to the 
flight route of flight MH17, which took off from the Netherlands? 

e What options did the Dutch State have to influence the decision-making related to 
foreign flight routes? 

e What indicators did the Dutch State (including the intelligence and security services, 
the AIVD and the MIVD "’”) have with regard to the safety of the flight route used by 
flight MH17 in the airspace above the eastern part of Ukraine? 


The investigation by the CTIVD 

At the request of the Dutch Safety Board, the Dutch Minister of the Interior and Kingdom 
Relations and the Dutch Minister of Defence asked the Dutch Review Committee for the 
Intelligence and Security Services (CTIVD) to conduct an investigation into the question 
whether the AIVD and the MIVD have a legal duty with regard to the decision-making 
pertaining to flight routes and how they implement it. The CTIVD is the body in the 





171 See for example Dutch Parliamentary documents II, 2014/2015, 33997, No. 36. 
172 AIVD: General Intelligence and Security Service of the Netherlands. MIVD: Military Intelligence and Security 
Service of the Netherlands. 
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Netherlands that monitors the legality of the implementation of the Intelligence and 
Security Services Act and the Security Clearances Act, and is authorised to view classified 
information. 


The CTIVD's report '’”° answers the following questions: 


e Do the Services have a legal duty with regard to the security of flight routes through 
foreign airspace? 

e How is the formal consultation structure organised between the AIVD and the MIVD 
and the civil aviation parties with regard to security issues, and what information 
exchange takes place in this respect? 

e What information did the Services possess prior to the crash regarding the security of 
civil flights above the eastern part of Ukraine, and did they share this knowledge with 
external parties? 


8.2 Formal responsibilities for flight MH17 


As explained in Section 4, states are responsible for managing the airspace within their 
borders (See Figure 76). States shall make all reasonable attempts to ensure the safety of 
civil aviation in the airspace. They can decide to open, close or restrict the airspace for 
civil aviation. It is their sovereign right to do so. In the case of flight MH17, the State of 
Ukraine was responsible for the airsoace management in the area where the crash 
occurred. 


Based on the decisions made by the Ukrainian authorities, on 17 July 2014 civil aeroplanes 
were permitted to use the airspace above the conflict area (Dnipropetrovsk FIR) above 
FL320. This also applied to Malaysia Airlines flight MH17 (also see Section 6 and 7). 


Flight MH17 was a flight operated by a Malaysian operator. It is regulated by the Malaysian 
authorities. Only the State of the Operator, i.e. Malaysia, could (in theory) have prohibited 
the operator from using the open flight route above the conflict area or have issued the 
operator with recommendations or instructions related to flying over the area. Regardless 
of whether Malaysian legislation offers this possibility, it can be established that the 
Malaysian authorities did not issue any flight prohibition or restriction. The responsibility 
for the decision to fly over the area is therefore fully borne by Malaysia Airlines. 


The above means that Ukraine, Malaysia and Malaysia Airlines bore certain responsibilities 
with regard to the operation of flight MH17 based on national and international law. The 
Dutch State did not bear such responsibilities. A state does not bear any responsibility 
with regard to flights operated by a foreign operator in foreign airspace, even if the 
operator departs from the state’s territory. 


173 See Appendix T. The CTIVD is responsible for the content of the appendix, including the terminology used. This 
may deviate from the terminology used by the Dutch Safety Board. 
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The fact that a code share agreement with KLM applied to flight MH17 had no impact on 
the Dutch State’s responsibilities. According to this agreement, the operator that actually 
operates the flight is responsible for the flight's safety (see also Section 4).'* Based on 
this agreement, KLM also had no obligation to warn Malaysia Airlines about any potential 
danger.'”° 


8.3. The options open to the Dutch State in relation to flight routes 


Although the Netherlands played no formal part in selecting the route taken by flight 
MH17, it is conceivable that the state could have informally exerted some influence, such 
as by warning operators about threats posed by the conflict area. The Chicago 
Convention and its Annexes, provide room for States to prohibit operators based in their 
territory from using foreign airspace, or issue recommendations on the matter (see also 
Section 7). Every state, so also the state of departure, can provide information about 
foreign airspace. Although this type of information is usually intended for its ‘own’ 
operators, it can also be made available to operators that take off or land in the state 
issuing the information or fly through its airspace. 


This Section describes how the Dutch State interprets its role with regard to these types 
of situations. 


8.3.1 Civil aviation safety in the Netherlands 
In the Netherlands, the responsibility for the safety and security of the airspace is shared 
between different departments.’ The NCTV ‘” is responsible for civil aviation security in 
the Netherlands. This concerns the measures at aerodromes that are meant to prevent 
unlawful acts that form a danger to civil aviation. 


The Ministry of Infrastructure and the Environment is responsible for civil aviation safety 
and is also responsible for in-flight security. An aircraft is deemed ‘in flight’ as from the 
moment that the exterior doors are closed after boarding and the engine power is used 
to take off. This part of aviation security is specifically related to security measures on 
board an aircraft. These measures are often subject to the certification requirements of 
the aircraft (think of the reintorced cockpit doors). An exception to this is the deployment 
of air marshals.'’”° The deployment of air marshals takes place under the responsibility of 
the Ministry of Security and Justice because it involves a policing task. As soon as the 
door of the aeroplane is closed, in the context of this report and Section (security), it 
becomes a matter of ‘in-flight security’, not ‘in-flight safety’. 





174 |n accordance with the code share agreement between KLM and Malaysia Airlines. This is a common provision in 
such agreements. 

175 KLM states that it would have passed on any actual threat-related information to code share and alliance partners 
if any had existed. However, KLM, partly based on informal contacts with the Dutch intelligence services and other 
airlines, did not perceive any threat and also flew over the eastern part of Ukraine. 

176 Ministry of Security and Justice/NCTV: National Civil Aviation Security Programme (NCASP), April 2014. 

177 The National Coordinator for Security and Counter-terrorism (NCTV), part of the Ministry of Security and Justice. 

178 An air marshal or sky marshal is an armed, plain-clothed security officer who travels on a commercial aircraft to 
combat any potential acts of terrorism. 
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Dutch airspace security is the joint responsibility of the Ministry of Infrastructure and the 
Environment and the Ministry of Defence. Air traffic services security (including air traffic 
control) also falls under the primary responsibility of the Ministry of Infrastructure and the 
Environment. Whenever the Ministry of Security and Justice bears primary responsibility, 
the Ministry of Infrastructure and the Environment is involved, and vice versa. 


In the Netherlands, aerodrome security falls under the responsibility of the NCTV. With 
regard to the aerodromes, the NCTV is the competent authority for the Royal Netherlands 
Marechaussee. The Royal Netherlands Marechaussee is charged with the execution of 
the policing task at Schiphol Airport and at the other aerodromes indicated by the 
Minister of Security and Justice and the Minister of Defence, as well as with civil aviation 
security. For aerodrome security, the NCTV, in the context of the Counterterrorism Alert 
System, asks the AIVD, the MIVD and the Central Intelligence Service of the National 
Police (DLIO) to produce semi-annual updates of the threat analysis for civil aerodromes. 
The NCTV acts on the basis of the information provided by the services and the police. 


In its threat analysis, the AIVD not only includes threats to national aerodromes, but also 
associated threats to inbound aeroplanes in the Netherlands (e.g. those arriving from risk 
areas), threats to Dutch operators abroad (e.g. the safety of a Dutch crew during their 
stay abroad), the security at foreign destination aerodromes, threats from terrorist groups 
to civil aeroplanes that are going to land in or possibly overtly the Netherlands and 
threats to aircraft departing trom the Netherlands (e.g. a threat in the Netherlands).'”’ 


Once a year, the NCTV produces a threat analysis for the aviation sector, which primarily 
concerns national aspects and the threat of terrorism in the Netherlands. This also 
includes attacks inside the aeroplane or external attacks directed at the aeroplane in 
Dutch airspace. 


Dutch operators can also ask the Dutch intelligence services for information about 
potential threats abroad. In the event of an actual threat against Dutch operators, the 
authorities consider it their duty to actively share information. The intelligence and security 
services play a major role in this respect (see paragraph 8.3.2). In other words, the 
Netherlands provides information to operators both on request and on an unsollicited 
basis, but does not issue any recommendations pertaining to flying over conflict areas. In 
interviews with the Dutch Safety Board, respondents from the NCTV and the Ministries of 
Infrastructure and Environment and Foreign Affairs provided the following reasons for 
this: 


e The state that manages the airspace may view any interference with this management 
as a violation of its sovereignty, which could damage diplomatic relations with the 
state concerned; 

e Operators are responsible for safe flight operations. By directing in this area, the state 
assumes this responsibility and this is not a desirable situation; 

e The Netherlands can never have sufficient information at its disposal to guarantee the 
safety of civil aviation (and civilians in general) in other states; 





179 See Appendix T. 
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e The state has no legal power to impose an over-flight prohibition pertaining to other 
states on national operators, and furthermore has no right to impose such a 
prohibition on foreign operators departing from the Netherlands; 

e Adopting a directing role with regard to flying over other states could result in an 
increase in liability claims. 


Despite the above, the Ministry of Foreign Affairs has recently begun including advice 
concerning the flight route - if relevant - in travel advice about areas with a possible threat.'°° 


8.3.2 The tasks of the AIVD and the MIVD 

In short, the legal security duties of the AIVD and the MIVD involve the Services 
conducting investigations into threats to national security.'°' In doing so, the AIVD 
focuses on civil aspects and the MIVD on military aspects. The AIVD and the MIVD are 
also charged with the task of conducting investigations regarding other states.'°* This is 
called the foreign intelligence task. The AIVD and the MIVD also have a task to promote 
measures to protect the interests served by the Services.'** This is called the security 
promotion task. 


The legal security and intelligence tasks of the AIVD and the MIVD do not include 
conducting independent investigations into the satety of foreign airspace, and thus into 
the safety of flight routes that use it.'** This is because the Services’ task allocation is 
linked to the central government's responsibilities. The Dutch authorities have no control 
over and thus no responsibility for any foreign airspace. The safety of foreign flight routes, 
however, is part of the AVID’s security promotion task.’ This is not an independent 
investigative duty, but a task that is mainly fulfilled using information collected by 
investigations performed as part of the security and intelligence task. 


As part of its security promotion task, the AIVD makes a contribution to the provision of 
information to Dutch operators, by sharing information about actual threats, on its own 
initiative, with the NCTV and Dutch operators and also by acting as a source of 
information for Dutch operators. For this purpose, the AIVD has an account manager for 
the civil aviation sector who maintains contact with (among others) the security managers 
of Dutch operators. The CTIVD concludes that, as part of the AVID’s security promotion 
task, the Service cannot be expected to independently assess which information 
operators need. Therefore, operators are expected to take the initiative; they have to 
approach the AIVD.'°° 





180 One example is the travel advice for Egypt, Jordan and Israel. It warns of threats in the airspace above the Sinai 
desert: ‘The air traffic that makes use of the airspace above the Sinai may encounter a terrorist threat. Prior to your 
trio, ask your airline or travel organisation whether they take this threat into account with the flight route.’ http:// 
www.rijksoverheid.nl/onderwerpen/reisadviezen, consulted on 22 July 2015. 

181 This is the so-called ‘a’ task of the AIVD (Article 6 paragraph 2 subsection a Wiv 2002) and the ‘a’ and ‘c’ tasks of 
the MIVD (Article 7 paragraph 2 subsections a and ¢). 

182 This is the so-called ‘d’ task of the AIVD (Article 6 paragraph 2 subsection d Wiv 2002) and the ‘e’ task of the MIVD 
(Article 7 paragraph 2 subsection e). 

183 This is the so-called ‘c’ task of the AIVD (Article 6 paragraph 2 subsection c Wiv 2002) and the ‘d’ task of the MIVD 
(Article 7 paragraph 2 subsection d). This task of the MIVD is completely concerned with the defence sector, 
including the defence industry. Civil aviation is not part of its scope. 

184 See Appendix T. 

185 This task focuses on promoting the protection of important and vulnerable parts of society in the Netherlands (see 
Appendix T). 

186 See Appendix T. 
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The MIVD shares actual threat information with the NCTV. The MIVD maintains only 
informal contacts with the operator KLM. 


The AIVD has shared actual threat information in the past. This was done, for example, in 
October 2013, when there were indications that armed groups in the Sinai desert (Egypt) 
possessed portable surface-to-air missiles and that they had the intention of shooting 
down civil aeroplanes. At the time, the AIVD issued a report to the NCTV, the Ministry of 
Foreign Affairs and Dutch operators.'°” 


In accordance with the AIVD's policy, the Service considers there to be an actual threat if 
three threat factors are present: capacity (availability of resources), potential (capabilities 
of resources and actors) and intention (motives). The AIVD uses these factors to estimate 
the severity and probability of a threat. The MIVD uses slightly different terminology, but 
adopts a similar approach for determining a threat. The MIVD derives intention from the 
objective (or strategic objective) of the enemy or group, its ideology and its military 
doctrine. The MIVD includes the possibilities of the resources and of the actors (potential) 
in the capacity factor and also uses the activity factor (the series of acts involved in 
executing the threat). 


The CTIVD concluded that the threat factors used by the AIVD and the MIVD constitute 
an effective basis for assessing whether an actual threat exists. The Committee does 
however recommend that the Services examine the extent to which they can align the 
terminologies they use.'°° 


8.3.3 The tasks of the NCTV 

Setting rules or issuing recommendations about flying through foreign airspace is not 
one of the NCTV’s tasks. However, if, for example, information trom the intelligence 
services (that is not directly related to the NCTV’s legal duty) is received by one of the 
NCTV directorates, the NCTV, the Ministry of Foreign Affairs and the Services do share it 
with parties whom it could benefit. This also applies to information related to risks to civil 
aviation in foreign airspace. 


The investigation of the Dutch Safety Board demonstrates that the NCTV bases the 
severity and probability of a threat on threat factors: capacity (availability of resources), 
potential and intention. Potential refers to the possibilities of the resources and actors to 
actually cause damage (in this case to aviation). Intention presupposes acting with a 
preconceived motivation. The NCTV only considers there to be an actual threat if there is 
potential and intention. In that case, the NCTV will actively issue a warning to operators. 
When there is potential, but there are no indications of intention, the NCTV does not 
consider it has any role to play. The NCTV assumes that, in such a case, other parties (i.e. 
the State that manages the airspace as well as the operators) will take responsibility. 


187 See Appendix T. 
188 See Appendix T. 
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8.4. What information did the Dutch State possess and what did it do with it? 


This Section describes how the Dutch State acted with regard to flying over the conflict 
area in the eastern part of Ukraine prior to the crash involving flight MH17. In doing so, it 
addresses the main sources of information, the information related to the armed conflict 
and possible threats to civil aviation (especially Dutch operators) that was available, and 
what was done with this information. 


8.4.1 Information position 

During the months leading up to the crash of flight MH17, the Netherlands gathered 
information about the situation in Ukraine both via the intelligence and security services 
and trom the embassy in Kyiv. With regard to military developments, the Netherlands had 
virtually no information position in Ukraine trom the autumn of 2013 onwards. A Dutch 
team that was once put together to conduct observations in Ukraine was dismantled in 
August 2013. 


The AIVD did not have a separate investigative mission focusing on Ukraine. The AIVD 
did conduct an investigation into the Russian Federation, which originated from the 2011- 
2016 Foreign Intelligence Designation Order. This concerns the AIVD’s foreign intelligence 
task. As part of this task, the AIVD gathers intelligence that can support the government 
in determining foreign policy and conducting international negotiations. This is also 
called ‘political intelligence’. 


When the unrest in Ukraine escalated from February 2014, the Ministry of Foreign Aftairs 
requested the AIVD to also report on developments in political circles in Ukraine in 
March 2014. During the period prior to the crash, the AIVD team’s tocus was on the 
political power play in Ukraine and the Russian influence on the latter. The AIVD team 
examined the information it received from this perspective. The AIVD team did not 
collect information related to the military capacities of the parties involved in the armed 
conflict in the eastern part of Ukraine. The team did receive information that offered a 
broader perspective of the conflict in the eastern part of Ukraine and of the military 
capacities and activities of the parties involved. The team used this information as 
background information to support its investigative mission. 


The MIVD did not have an investigative assignment focused on Ukraine.'®’? However, 
there was an MIVD team that focused on the Russian Federation's foreign, security and 
defence policies. This involved the team examining the proliferation of Russian weapons, 
military knowledge and technology. In March 2014, the MIVD was assigned the mission 
of providing weekly reports on the crisis between Ukraine and the Russian Federation. 
This led to a slight shift in the focus of the investigation into Russian military capacities 
and capacities in the vicinity of Ukraine. Attention was also devoted to the possible threat 
of a Russian invasion of Ukraine. This working method provided a more complete picture 
of the Russian capacities than those of the Ukrainian armed forces and the armed groups 
that were fighting the Ukrainian government.'”° 


189 See Appendix T. 
190 See Appendix T. 
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Some of the information about the situation in the eastern part of Ukraine that the Dutch 
State possessed originated from the Dutch embassy and from the defence attaché who 
worked there. The defence attaché falls under the responsibility of the Chief of Defence 
and reports in the first instance to the Ministry of Defence, although he can also gather 
information to benefit the MIVD's implementation of its tasks. He serves as a (military) 
adviser to the ambassador (Chef de Poste). In 2013 the Netherlands had a defence 
attaché for Ukraine, but the post in Kyiv was a ‘travelling defence attaché post’ based at 
the station in The Hague. The post in Kyiv was combined with the ones in Warsaw and 
Prague. The defence attaché visited the post in Kyiv three or four times a year. 


From the end of February 2014, when internal tensions and concern about the role of the 
Russian Federation therein increased, the role of travelling defence attaché was scaled 
up to ultimately become a permanent station in Kyiv (‘resident defence attaché). 
Henceforth, the defence attaché was assigned the mission of making an inventory of the 
parties in the conflict, noting significant developments and indicating their possible 
consequences for the Netherlands and Europe. 


The defence attaché’s tasks did not include identifying potential risks to civil aviation. He 
had no contact or virtually no contact with Dutch operators. 


8.4.2 The information that was available 


8.4.2.1 The MIVD and the AIVD 

The MIVD had information that, in the months prior to the investigation into the crash of 
flight MH17, the groups fighting the Ukrainian government were increasing their military 
capability. They were also trying to get hold of anti-aircraft systems, because they were 
being attacked from the air by Ukrainian armed forces. The MIVD knew that the armed 
groups possessed MANPADS and possibly short-range ‘vehicle-borne’ air defence 
systems. Both types of systems are considered surface-to-air missiles (SAMs), but do not 
pose a threat to civil aviation at cruising altitude due to their limited range.'”' Statements 
made by NATO General Breedlove at a press briefing on 30 June 2014 about build-up of 
weapons and training across the border in the Russian Federation (see Section 5) contained 
little new information for the MIVD. The terms ‘vehicle-borne capability’ and ‘air-detence 
vehicles’ are generic and are also used to refer to short-range air defence systems. 


The AIVD was also aware that the groups fighting the Ukrainian government were 
obtaining more and increasingly powerful weapons during the months leading up to 
17 July, including MANPADS and possibly short-range, vehicle-borne air defence systems. 


On 16 July, the AIVD received a report from a reliable source stating that there was no 
information to indicate that the armed groups fighting the Ukrainian government 
possessed anti-aircraft systems which could have downed the Antonov An-26 from 
6,500 metres on 14 July (see Section 5).'”7 


191 See Appendix T (Section 5.2.2. of the CTIVD report). 
192 See Appendix T. 
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The MIVD launched an investigation into the downing of the Antonov An-26 on 14 July. 
The reason for this were the statements in the media by the Ukrainian authorities that the 
aeroplane was flying at 6,500 metres'”’ and was shot down with a powerful anti-aircraft 
system (a medium-range surface-to-air missile or an air-to-air missile) by, or even trom 
inside, the Russian Federation. If this was the case, then Russian participation in the 
conflict would have become a fact; this was sufficient reason for the MIVD to launch an 
investigation. On 17 July 2014, the MIVD shared the results of this investigation with 
several parties, including the NCTV and the AIVD. According to the MIVD's assessment, 
it was unlikely that the Antonov had been shot down with a powerful air defence system 
(aside from the question of whether this occurred inside Russian territory). Images of the 
wreckage and eye witness statements showed that the aeroplane was struck in the right 
engine and that subsequently 5 to 6 parachutes appeared. After these events the 
Antonov crashed. On the basis of this information the MIVD concluded that the damage 
to the aeroplane was not consistent with the damage that would be caused by a powertul 
anti-aircraft system. In that case the aeroplane would have been destroyed in the air. 
According to the MIVD the wreckage and the eyewitnesses support the fact that the 
aeroplane was downed with a MANPADS originating from inside Ukrainian territory. This 
is only possible if the Antonov was flying considerably lower than 6,200m or 6,500m. 
Another possibility is that a short-range vehicle-borne air defence system was used. The 
information received from the MIVD does not point to the use of a powerful air defence 
system. The possibility that the aeroplane was shot down with an air-to-air missile was 
not mentioned. 


The CTIVD established that neither Service possessed any information prior to 17 July 2014 
that indicated that the groups fighting the government had operational and powertul air 
defence systems such as a Buk (SA-11). Although the MIVD had various unconfirmed 
reports that the armed groups had at least one Buk M1 (SA-11), most probably from the 
Ukrainian air defences, based on various reliable intelligence sources, the MIVD concluded 
that the system was not operational. Both the MIVD and the AIVD possessed information 
that the armed groups fighting the government were motivated to shoot down military 
aircraft. However, the services had no indication that the armed groups had the intention 
of shooting down a civil aeroplane. 


The CTIVD’'s investigation revealed that the MIVD and the AIVD possessed information 
that the Ukrainian and Russian forces did have powerful air-defence systems. The Russian 
armed forces on the territory of the Russian Federation near the border with the eastern 
part of Ukraine; the Ukrainian armed forces in the west of Ukraine and a number in the 
eastern part of the country. The Services did not possess any information indicating that 
one of these actors had the intention to shoot down a civil aeroplane. 


The CTIVD concluded that the Services had no indications of an actual threat against civil 
aviation prior to the crash of flight MH17. The material available to the Services does not 
indicate that any of the actors involved in the armed conflict in the eastern part of Ukraine 
displayed a combination of military resources, abilities and the intention to shoot down a 


193 Ina briefing for diplomats, an altitude of 6,200 metres was mentioned; in response to additional questions by the 
Dutch Safety Board, in July 2015 an altitude of 6,300 metres was mentioned. 
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civil aeroplane at cruising altitude prior to the crash. The CTIVD concluded that, based 
on the available information, the MIVD and the AIVD could not have been expected to 
identity any actual threat to civil aircraft above the eastern part of Ukraine or share it with 
external parties. During the investigative period (January 2014 through 17 July 2014), 
neither Service received an explicit or implicit warning from its foreign partner services 
concerning a risk to civil aviation above the eastern part of Ukraine. 


The CTIVD has also established that none of the Dutch operators contacted the MIVD or 
the AIVD to enquire about the security situation in the eastern part of Ukraine prior to 
17 July 2014. 


8.4.2.2. Embassy of the Netherlands in Kyiv 

The Dutch Safety Board investigated what information the Embassy of the Kingdom of 
the Netherlands to Ukraine, including the defence attaché stationed there, possessed. 
From the time when the internal tensions began to intensify in Ukraine (beginning of 
2014) until the crash on 17 July, many hundreds of messages were sent from the embassy 
to the Ministries of Foreign Affairs and Defence. From March 2014, the messages reveal 
that, on weekdays, one or more updates related to the situation in Ukraine were sent 
virtually daily. Initially, the emphasis was on the situation in the Crimea, but later, attention 
shifted to the eastern part of Ukraine, where the conflict between armed groups and the 
Ukrainian government escalated. 


The reports mainly pertained to instability, developments in the fighting between 
Ukrainian armed forces and the armed groups, and the possible role of the Russian 
Federation therein. This was all viewed from a military-strategic and geopolitical 
perspective: what were the consequences for Ukraine's political (in)stability, and what 
dangers did the Russian Federation’s troop movements and build-up of weapons pose 
to the security of Ukraine and Europe? 


None of the messages make any connection to risks posed by the conflict in the eastern 
part of Ukraine to overtlying civil aeroplanes.'’* Even the defence attaché who, as already 
mentioned, was responsible for making an inventory of military developments, admitted 
that he did not make any connection between the developments on the ground and 
overflying civil aviation. The defence attaché participated in a weekly consultation with 
defence attachés from other - mainly Western - states, also in the context of NATO, about 
matters that included the military developments in the eastern part of Ukraine. They 
noted that the fighting was expanding into the air, and that the armed groups were trying 
to neutralise the air superiority of the Ukrainian armed forces from the ground. According 
to the Dutch defence attaché, there was no mention of potential risks posed by this 
escalation to civil aviation at any of these meetings. According to him, there was no 
awareness that civil aviation routes existed above the conflict area. The defence attachés 
from the different states jointly evaluated the crash of flight MH17. Their conclusion was 
that nobody had considered the possibility of a civil aeroplane being shot down. 


194 Section 5 explains that such a link does appear to have been made in an OSCE memorandum from March 2014 
regarding Crimea, which also reached the Dutch embassy. 


i = y 4 240 of 279 


Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 


7 Flying over 
Ukraine 


Part B: 
9 Assessing the 
aL « 


a 
Recommendations 


16 
List of appendices 





The reports from the embassy reveal that, prior to 17 July 2014, there were several 
reports of a military aircraft being shot out of the air. The downing of the Antonov An-26 
on 14 July 2014 was also mentioned. As mentioned in Section 5, the Presidential 
Administration held a closed briefing for heads of the diplomatic missions in Ukraine on 
the same day. A representative from the Dutch embassy attended this meeting.’” In the 
briefing’s report, the representative mentioned this fact, but did not make any connection 
with the possible risks to civil aviation. The report explains that the Ukrainian authorities 
viewed the incident as proof of increasing involvement of the Russian Federation in the 
armed conflict and that they expected a reaction as well as solidarity from their 
international allies. The report reveals that the embassy staff member concluded that 
Ukraine, supported by the U.S. ambassador, was trying to put pressure on the upcoming 
European Council to expand sanctions against the Russian Federation. 


8.4.2.3. The NCTV 

The NCTV claimed not to have played any significant role in analysing the situation in the 
eastern part of Ukraine. According to the NCTV, the information trom the eastern part of 
Ukraine was only of importance to the Dutch State because of the conduct of the Russian 
Federation and its potential geopolitical consequences. According to the NCTV, none of 
the Dutch parties involved, nor other states, made any connection between the conflict 
and risks to civil aviation. Based on previously attacked targets and the nature of the 
conflict, the NCTV saw no reason to assume that Dutch targets would be attacked 
deliberately. For the NCTV, the presence of intention constitutes part of the basis for 
establishing a threat. In this case, according to the NCTV, the Dutch State could be of 
little use to the Dutch operators because the NCTV did not possess any information that 
pointed to an actual threat. 


In the aftermath of the crash, the NCTV mainly focused on crisis management.'”° On 
31 August 2014, the NCTV compiled an account of facts on behalf of the Ministerial 
Crisis Management Committee (MCCb) regarding the Dutch information position and 
information provision during the period leading up to the shoot-down of flight MH17 on 
17 July 2014.'”” This reveals that there was no information that pointed to any danger to 
civil aviation above an altitude of 9900 metres. The NCTV received information about 
surface-to-air missiles in the eastern part of Ukraine on two occasions. On 27 June 2014, 
the NCTV learned from the MIVD that groups that were fighting the Ukrainian government 
possessed (among other things) portable surface-to-air missiles (MANPADS). On 17 July, 
the MIVD sent a report to the NCTV's Threat and Risk Analysis Department, containing 
the results of the investigation into the downing of the Antonov An-26 on 14 July 2014. 
The account of facts also reveals that, on 17 July the MIVD reported to the NCTV it 
possessed intelligence indicating that Russian SA-11 and SA-20 surface-to-air missiles'”®° 
were present on Russian territory near the border with the eastern part of Ukraine, but 
that their actual use could not be established by radar data. Moreover, the account of 
facts reveals that, according to the MIVD, there were also various unconfirmed reports 





195 According to the report by the embassy staff member, representatives were present from the embassies of the EU 
Member States, the US, Canada, Brazil and Japan. 

196 See The Dutch Safety Boards’ Report MH17 - Passenger information. 

197 This concerns an internal memorandum that was not adopted officially. 

198 An SA-11 is the U.S. term for a type of Buk, a medium-range anti-aircraft missile. The SA-20 is a long-range anti- 
aircraft missile. 
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that the groups fighting the Ukrainian government possessed at least one Buk-M1, which 
probably originated from the Ukrainian air defence. As mentioned above, the CTIVD 
established that the MIVD knew from several reliable intelligence sources that the system 
was not operational.'”’ 


In summary it can be stated that the Dutch authorities did not perceive any threat to civil 
aviation above the conflict area in the eastern part of Ukraine. For this reason, they also did 
not consider that there was any rationale for actively informing or warning operators. During 
the period prior to the crash of flight MH17, operators did not request any information from 
the AIVD or the MIVD about the security situation in the eastern part of Ukraine either. 


8.5 Analysis 


In the system of responsibilities there are explicit responsibilities related to states’ 
management of the airspace, to operators operating a flight, and to the supervision of 
the operators based in the state concerned. The state of departure as such does not 
feature in this explicit distribution of responsibilities (see also Figure 76 in Section 4). 


The Chicago Convention and its Annexes do not hinder ICAO Member States in the 
provision of advice to foreign operators about flying through the airspace of an other 
state. This also applies to the state of departure and foreign operators departing from 
that state. The ICAO framework offers states the possibility of promulgating legislation 
that makes flight prohibitions for foreign airspace possible for operators and airmen trom 
that state. Section 7 describes how a number of states, for example the U.S., the U.K. and 
Germany, make use of the possibility to promulgate a flight prohibition. 


The Dutch Services did not possess any information that indicated an actual threat to 
civil aviation above the conflict area in the eastern part of Ukraine. There were no 
indications that the groups involved in the armed conflict had the intention of targeting 
civil aviation and there were no indications that the groups that fought against the 
Ukrainian government possessed the capability to hit aeroplanes at cruising altitude. For 
that reason, no warning was issued to the operators. Nor did other states issue warnings 
to operators about flying over the conflict area in the eastern part of Ukraine. 


The Dutch information position in the spring of 2014 regarding the eastern part of Ukraine 
was still being built up and the focus was predominantly on developments related to the 
Russian Federation. This was not relevant to flight MH17: states with a more effective 
information position did not establish any actual threat either (see Section 7). 


The Dutch State considers it its responsibility to actively inform operators based in its 
state in case of an actual threat. Foreign operators that depart from the Netherlands do 
not receive such information from the Dutch State. Moreover, Dutch operators have the 
possibility of requesting security information about other states (demand-driven). The 
AIVD and the MIVD both play a role in this respect. The Dutch authorities do not consider 
it their task to advise operators or to prohibit them from flying over a conflict area. 


199 See Appendix T. 
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In foreign travel advice to Dutch travellers concerning risk regions the Ministry of Foreign 
Affairs will also in some cases issue a warning about the flight route to a destination. 
Such advice is an example of an initiative that is being taken by the Dutch government 
despite the lack of formal responsibility for the safety of flight routes. 


After the crash of flight MH17, the Ministries of Infrastructure and the Environment, 
Security and Justice, and Foreign Affairs consulted with Dutch operators (KLM, Corendon, 
ArkeFly) and the Dutch Airline Pilots Association to establish a system of information 
exchange and risk analyses.*°° Such a consultation is most valuable if it is given a fixed 
structure. This increases the likelihood that parties assess conflicts from a mutual 
perspective and that an integrated risk assessment occurs. 


The Dutch Safety Board will return to the cited basic principle of an actual threat, as 
adopted by the Dutch State as well as by many other states and operators, in Section 9 
of this report. 


8.6 Sub-conclusions 


1. As state of departure of flight MH17, the Netherlands bore no responsibility for 
issuing Malaysia Airlines, an operator based abroad, with recommendations or 
indications about flying over the eastern part of Ukraine, or for prohibiting it from 
using the airspace. 


2. The Netherlands did not have authority based on Dutch legislation to impose a 
flight prohibition on operators under their control from flying in foreign airspace. 


3. Prior to the crash of flight MH17 on 17 July, the Dutch intelligence and security 
services did not have any information about an actual threat to civil aviation using 
the airsoace above the eastern part of Ukraine. 





200 Ministry of Security and Justice, State of Affairs letter MH17, 30 June 2015. 
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9.1 Introduction 


In order to be able to learn from the crash of flight MHT17, it is important to investigate 
whether general factors, that go beyond this particular case, play a role. In this Section, 
the Dutch Safety Board identities factors that play a role in the risk assessment process 
related to flying over conflict areas and that are not unique to the crash of flight MH17. 
This Section begins with a summary of the findings pertaining to the crash, followed by an 
analysis of risk assessment processes in relation to flying over conflict areas. This is 
intended as a preamble to this report's final conclusions and recommendations. 


In addition to information from previous Sections, the Dutch Safety Board for this Section 
used supplementary information about the practices that states and operators generally 
employ in their risk assessments (see Appenaix VU). 


9.2 MH17: no integrated risk assessment 


This investigation reveals that, prior to the crash of flight MH17, none of the parties 
involved adequately identified potential threats that the conflict in the eastern part of 
Ukraine posed to civil aviation flying over the area. 


e The decision-making process related to Ukrainian airsoace was dominated by the 
military authorities and the interests of military aviation. The Ukrainian authorities did 
not adequately assess the risk for civil aviation. 

e Most operators assumed that an airspace which is not closed must be safe. Operators 
adapted their flight plans to accommodate the airspace restrictions, but did not make 
a connection with the armed conflict taking place below. Insofar as the Dutch Safety 
Board has been able to ascertain, there was one operator that discontinued its flights 
over that area out of caution due to the increasing unrest in Ukraine. But that was 
already before the armed conflict had arisen in the eastern part of the country. 

e Nor, insofar as the Dutch Safety Board has been able to ascertain, between the end 
of April and 17 July 2014, was there any state that prohibited operators based in that 
state trom flying over the area, or explicitly warned of possible threats in the airspace 
of the eastern part of Ukraine as a result of the conflict. There were states - although 
certainly not all states - that collected information about the conflict; they did so from 
a geopolitical and military perspective and did not make any connection to the risks 
to civil aviation flying overhead. 


The parties involved (Ukraine, operators, other states and international organisations) 
viewed the armed conflict from their own respective domains, with their own specific 
focus. In their risk assessments, operators primarily focus on threats on the ground 
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(origins and destinations, for example in relation to the aerodrome), flight crew, 
passengers, luggage and the aeroplane. When it comes to flying over conflict areas at 
high altitudes, almost all operators assume that any open airspace is safe. This was also 
the case with regard to the eastern part of Ukraine: the operators did not focus at all on 
the developments in the conflict on the ground in relation to the overflight thereof. 


The focus on risks on the ground (place of departure and destination) partly arises from 
Annex 17 to the Chicago Convention. This does not explicitly include the assessment of 
potential threats in foreign airspace at cruising altitude, although it does not preclude 
States from assessing such risks as necessary. The operators therefore focus on the safety 
of their take-off and landing locations. The crash involving flight MH17 reveals a lack of 
regulations related to risk management with regard to threats to the upper airspace. 


On the basis of this risk assessment method, the risks of flying over the eastern part of 
Ukraine were not identified. An integrated risk assessment, whereby parties also look at 
domains other than their own, and in which knowledge about the interpretation of the 
conflict was combined, was lacking. In retrospect, an integrated assessment should have 
led to the safety of civil air traffic being given more weight in the airspace’s management, 
that operators would also have scrutinised developments in the armed conflict on the 
ground, and that states who collected information about the armed conflict would have 
been more aware that there was a major corridor of civil aviation above. 


In the system of responsibilities, the emergence of a weak link (the airsoace management) 
did not lead to other parties taking action to help ensure the safety of civil aviation above 
the conflict area. This raises the question how risk assessments can be improved in such 
situations. 


9.3 Aviation in relation to conflict zones: patterns of risk assessment 


On the basis of the investigation, the Dutch Safety Board identified a number of patterns 
in risk assessments (for a detailed explanation, see Appendix U). These patterns apply to 
states as well as operators. States can play a major role in the decision-making on 
overflying of conflict areas, because they usually have other options for gathering 
intelligence than operators. Operators take the decision to actually use flight routes in 
airspaces. 





Interpreting information 
Threat analysis NI arclareI NAS 


Figure 88: Steps involved in the risk assessment process. (Source: Dutch Safety Board) 
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The risk assessment process can be divided into several steps. The first step involves 
gathering (and sharing) information, i.e. gathering information from various sources 
related to a potential threat and sharing information with other parties*°' (‘what could 
happen, is there intention and capability?’). After the information has been gathered, the 
following steps take place: 


e Threat analysis: determining the probability of a threat occurring; 

e Risk analysis: the assessment of the risks for the operator, based on vulnerability and 
consequences; 

e Decision-making: deciding whether or not to fly. If so, are additional measures necessary? 


As described in Section 6, armed conflicts are characterised by a high degree of 
unpredictability. The state responsible for the management of the airspace does not, in 
the event of a conflict, always have control of the territory under the airspace. It is often 
unclear who possesses which types of weapon systems and whether or how they will be 
used in the conflict. If non-state related parties are involved, they may not always regard 
themselves as bound by international treaties and conventions. As a result, such conflicts 
could constitute a risk to civil aviation. 


There are areas in the world other than the eastern part of Ukraine where armed conflicts 
are occurring. The lessons that can be learned from the crash of flight MH17 can 
contribute to a more effective risk assessment, also for these areas. 


9.3.1 Information gathering 

Although operators can gather information about what is going on in a conflict area with 
the help of public information, this information also has its limitations. For information 
from intelligence sources, the operators are dependent on intelligence services of states. 
Although operators also have security departments, these do not benefit from the 
resources and powers of the intelligence services. 


There turn out to be major differences in the extent to which states gather intelligence 
that may concern the safety of the operators under their control (see Section 7). There 
are states that only do this within their borders (such as Malaysia); there are states that 
gather intelligence beyond their borders on a limited scale, but which in principle do not 
consider themselves as having an active responsibility in relation to civil aviation (such as 
the Netherlands), and there are states that regard protecting civil aviation as a 
responsibility, passing on information and/or issuing flight prohibitions if necessary (such 
as the United States). These differences are related to states’ abilities to secure an 
intelligence position (capacity, diplomatic relationships with states, geopolitical position), 
but are also the result of choices the states make with respect to responsibility for the 
satety of operators. The willingness to become involved in the decision by sovereign 
states to keep their airsoace open also varies. In the crash involving flight MHT17, it 
appeared that the various roles adopted by states did not make any difference. However, 
since operators rely on information gathered by states, the crash could still be reason to 
reconsider the choices involved. 





201 As far as the parties involved are concerned, they predominantly share information if this action is reciprocated. 
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Not all states have the capacity to gather information about potential threats in other 
states. These states can still obtain information if other states are willing to share it with 
them. As a result of the crash involving flight MH17, the ICAO Task Force on Risks to civil 
aviation arising from Conflict Zones (TF RCZ) advocated a central information system, 
including a web application for NOTAMs, supplemented with relevant safety and security 
information pertaining to risks that conflict areas pose to civil aviation.*° 


In the meantime, several states, including the United States, the United Kingdom, France, 
Saudi Arabia, Germany, and the United Arab Emirates, have placed information on the 
website.*°° The initial evaluation of this online information system is planned for the end 
of 2015. There appears to be an increased willingness to promulgate advice and if needs 
be flight prohibitions for national operators with respect to operations in foreign airspace. 
After the crash of flight MH17, the United Kingdom has also started making threat 
information available (via NOTAMs) to all operators that could be under threat. This way 
of sharing relevant information from States of departure can be a complement to the 
international information-sharing that is presently given shape via the ICAO website. 


Furthermore, NOTAMs issued in relation to an armed conflict could include more specific 
information about the conflict, as proposed in ICAO Doc 9554-AN/932. In this context it 
is necessary that in the future automated flight plan systems will recognise this 
information, so that it is incorporated in the risk assessment process in a timely manner. 


9.3.2 Threat analysis: emphasis on an actual threat, intention and capability 

The parties involved focus too much on the potential risks involved in flying over conflict 
areas from the perspective of an actual threat. Establishing intention, i.e. the preconceived 
intention to shoot down civil aeroplanes or specific civil aeroplanes (for example from a 
particular state or belonging to a certain operator) carries considerable weight in this 
respect. Capability is also an important criterion, which must be demonstrated or at least 
be plausible. This approach leaves too little room for uncertainties. Uncertainties about 
these tactors are conventionally equated with their absence. A more qualitative approach 
can strengthen the analysis. Developments in the armed conflict can provide indications 
for an increased risk. The fact that the fighting in the eastern part of Ukraine expanded 
into the airspace could, for example, have been an indication that the safety of civil 
aviation flying over the area was deteriorating. 


If there is a lack of specific indications of intention, but also if capability cannot be 
satisfactorily demonstrated, the parties involved terminate their threat analysis. Less 
obvious indications for a threat disappear from the risk assessment process early on, 
without reaching the domain in which operational risk assessments are performed. This 
means that the unintended consequences of human actions, for example, are not 
considered. With the increase of military activities in the air, for example, there is a 
greater chance that civil aeroplanes are hit by a surface-to-air missile or air-to-air missile. 
The presence of medium or long range surface-to-air missiles in the immediate area of a 
conflict, or the deployment of air-to-air missiles in the conflict, increases that risk. 


202 ICAO Conflict Zone Information Repository, launched in April 2015. 
203 ICAO Conflict Zone Information Repository, state of affairs July 2015. 
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9.3.3 Risk analysis: factors that increase risk 

To facilitate a more effective assessment of the risks posed by conflict areas based on 
the threat analysis, ICAO,*°* in 2015, identified a number of factors that may increase 
these risks for civil aviation. The application of these factors that increase risk could result 
in the risk assessment producing a different outcome. ICAO has restricted itself to 
situations in which possible medium or long-range surface-to-air missiles are present, 
because these form the largest risk for civil aviation at cruising level. 


The factors that ICAO believes contribute to risks, and should therefore weigh more 
heavily in determining the threat and the risk of civil aircraft being shot down, are: 


e Civil aviation is the target of one of the fighting parties; 

e Those operating the anti-aircraft missiles are poorly trained or inexperienced (possibly 
in combination with the absence of a properly functioning command structure); 

e Flights involving military aeroplanes in a combat role are taking place; 

e Military transport flights are taking place; 

e Flight routes run through or close to locations of strategic importance, which can be 
attacked from the air: 

e The absence of effective air traffic management above the area, for example because 
the state in which the armed conflict is occurring does not have complete control 
over Its territory. 


The Dutch Safety Board believes that these criteria can be used to obtain a more effective 
analysis of the risks posed by conflict areas to civil aviation flying over them. The Board 
also points out that not all the factors need to be present at the same time in order to 
speak of an increased risk. Each separate factor deserves attention. According to the 
Board, such an analysis should adequately focus on the trends that are observed in a 
certain period: are, for example, the air operations or shootings of military aircraft, 
particularly by non-state actors,*” increasing? Is the altitude at which military aircraft are 
operating increasing? Although this still only entails a low probability that civil aeroplanes 
will be hit, these are not inconceivable events. Given the severity of the consequences 
and the possibilities for managing the risk, these small probabilities deserve 
attention - and not or not solely in a strictly quantitative, but in a qualitative manner. This 
subject will return in the next paragraph. 


9.3.4 Risk analysis: the role of probability 

In the tield of risk analysis, statistical data constitute the basis for determining the probability 
of a particular incident occurring: has the incident already occurred in the past, and if so, 
how often? Moreover, the potential impact is important, i.e. the expected severity and 
scope of the damage. With the help of a risk matrix, both factors (likelihood and severity) 
are combined, resulting in risk categories that can be linked to mitigating measures. This is 





204 ICAO Working Group on Threat and Risk (WGTR), HLSC/15- WP/10, 7 January 2015. 
205 In its summary of the risk-increasing factors, ICAO indicates that the chance of misidentification of military 
aeroplanes in the use of long-range surface-to-air missiles is the greatest with non-state groups. 
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a professional working method that is an established practice in civil aviation. ICAO also 
describes these methods in its documents and uses a risk index matrix (Figure 89).*°° 





IVT ata 
Likelihood 
3 Moderate 5 Catastrophic 

A Certain/ Moderate Moderate High Extreme Extreme 
frequent (1A) (2A) (3A) (4A) (5A) 

B Likely/ Low Moderate Moderate High Extreme 
Occasional (1B) (2B) (3B) (4B) (5B) 

C Possible/ Low Low Moderate Moderate High 
remote (1C) (2C) (3C) (4C) (5C) 

D Unlikely/ Negligible Low Low Moderate Moderate 
improbable (1D) (2D) (3D) (4D) (5D) 

E Exceptional Negligible Negligible Low Low Moderate 

(1E) (2E) (3E) (4E) (SE) 











Figure 89: Example of a risk index matrix. (Source: ICAO Safety Management Manual Doc 9859) 


The idea behind such a matrix is that activities that involve an extreme risk (4A, 5A and 
5B) must be terminated immediately or may not be undertaken. The activities may only 
be continued if the risk has been reduced to an acceptable level. In the event of a lower 
risk level, measures are required that limit the risks. One such measure could be the 
decision to avoid an area. Other measures related to flying over a conflict area could be, 
for example, the obligation to have certain equipment on board, increasing the 
recognisability of civil aircraft, providing pilots with additional instructions prior to a flight 
and/or providing additional instructions for performing an emergency landing in a 
conflict area if necessary. 


The scenario involving civil aeroplanes at cruising altitude being hit, either intentionally 
or unintentionally, by surface-air-to missiles or air-to-air missiles is improbable, also from 
the perspective of risk analysis. Statistically, the probability of such an event taking place 
is low. Similar events only occurred a few times in the past (see Appendix S). In relation to 
the total number of civil flights, the number is so small that statistically the probability is 
extremely low. 


The crash of flight MH17 teaches us that, in order to obtain and hold onto this scenario, 
another risk approach is needed, one that is more qualitative, and that is applied 
specifically, per conflict area. Its input does not consist of historical series of similar 
incidents or the established actual threat, but the scenario’s conceivability (‘is it 
possible?’). Such an approach is justified because the consequences in this scenario are 
extremely severe (‘catastrophic’ in the terms used in the risk matrix) and because 
measures are available that reduce the risk. For arriving at an informed judgement about 


206 Especially for threats in the security domain, ICAO uses a different but comparable matrix, assuming many more 
intentional actions. 
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a scenario’s conceivability, ICAO’s risk factors for assessing armed conflicts (see previous 
paragraph) are useful. Per conflict area, an assessment can then be performed which, as 
mentioned in the previous paragraph, should also focus on an analysis of the manner in 
which a conflict develops as advised by the Dutch Safety Board.*°” 


The application of this working method in the case of the eastern part of Ukraine could 
have led to a shift in the assessment of the likelihood. As a result, the risk category would 
shift too, meaning that the urgency of measures becomes greater. 


To summarise: this method of approaching risks implies that the parties involved in flying 
over conflict areas should not limit themselves strictly to examining the statistical 
probability of scenarios. They would have to arrive at an informed judgement related to 
the possibility of a scenario based on risk-increasing factors and a trend analysis. 


9.3.5 Decision-making: the pressure to carry on flying 

The international system for civil aviation is based on the assumption that, in principle, 
civil aviation is always possible: By default, flights take place. As stated in Section 4, 
states that manage their airspace shall impose as few restrictions on civil aviation as 
possible. This system can provide an incentive to keep the airspace open if potential 
dangers to air traffic are not yet entirely clear. 


Flying is also the default for operators. When it comes to new flight routes, they assess 
whether they want to fly somewhere, whereas continuing to fly along existing routes over 
conflict areas is a ‘non-decision’ in most cases. The investigation revealed that operators 
only reassess existing routes for safety reasons if there are specific indications of danger. 
This has an impact on the risk assessment process, however. It determines how operators 
collect and interpret threat-related information. They use available information to justify 
continuing to fly and to carry on doing what they were doing already. This was the 
perspective with regard to flying over the eastern part of Ukraine: the operators viewed 
the NOTAMs issued by Ukraine prior to 17 July 2014 as a sign that Ukraine was controlling 
the airspace, not as an indicator of a deteriorating security situation in the air. 


9.3.6 Consequences for the risk analysis 

The above shows that current armed conflicts can pose risks to civil aviation due to their 
unpredictability, and that the system of responsibilities and the risk assessment process 
are still inadequately equipped in this respect. In states that have to cope with an armed 
conflict, the satety of the airspace above the conflict cannot be guaranteed in advance, 
not even at cruising altitude. The Dutch Satety Board is of the opinion that states should 
also assume their responsibilities for the safety of the airspace in a conflict situation, but 
that additional action may also be required from other parties. 


Firstly, it requires an integrated risk assessment to be performed. Parties that view the 
conflict from a military or geopolitical angle should be more aware of potential secondary 
effects on civil aviation. Knowledge of the main flight routes could increase this 


207 ICAO Doc 9859, Chapter 2, Paragraph 14.6 supports this: ‘Organisations may include both qualitative and 
quantitative criteria...’ 
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awareness. Operators that want to fly over a conflict area should take into account the 
potential risks posed by that conflict. A structured consultation between the various 
parties about flight routes could promote such an integrated risk assessment. 


Since intention and capability carry considerable weight in threat analyses, potential risks 
posed by an armed conflict can be dismissed in the analyses too quickly. This can also 
happen due to the emphasis on statistical probability in risk analyses. By focusing more 
on risk-increasing factors related to armed conflicts, and by devoting more attention to 
the development of such a conflict, the risk analysis can become more effective. 


9.4  Sub-conclusions 


1. Given the vulnerability of states facing an armed conflict, operators and other 
aviation parties may not assume in advance that the airspace above the conflict 
zone is safe. They should perform their own assessment of the risks involved in 
overflying conflict areas. 


2. Whenever states (can) have access to information that is relevant to that risk 
assessment, they should share this information with operators in a structured 
manner. States that collect information about conflict areas could take account of 
airspace usage patterns for civil aviation. 


3. Existing threat analyses only consider a threat to be actual if both capability and 
intention have been established with sufficient certainty. Even if there is no 
certainty with regard to these factors, an armed conflict may still pose risks to 
civil aviation. In the current practice of risk assessment, these risks are too soon 
considered unlikely. 


4. The identification and the use of risk-increasing factors are important for 
obtaining a better understanding of the likelihood of scenarios in an armed 
conflict. 


251 Or 277 












Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 
7 Flying over 
Ukraine 


Part B: 
9 Assessing the 
aL « 


ai 
Recommendations 


16 
List of appendices 


Contents 





Foreword 


Uanleat- lay 





1 
Introduction 


Part A: 
2 Factual 
information 





Part A: 
3 Analysis 


Conclusions and eee 
Recommendations 





Part B: 
4 Decision making 


Part B: 
5 The situation 





Part B: 
6 Flight MH17 


Part B: 
7 Flying over 
Ukraine 





Part B: 
8 The state of 
departure 


Part B: 
9 Assessing the 
aL « 





10 
Conclusions 


ai 
Recommendations 





12 
Abbreviations and 
Definitions 


£52 OF a7? 13 





List of appendices 













The findings of the investigation into the crash of flight MH17 on 17 July 2014 lead to the 
following conclusions. 


10.1 


Main conclusions 


1. Causes of the crash 


a. 


On 17 July 2014, Malaysia Airlines operated flight MH17, an airworthy Boeing 
777-200 with the registration 9M-MRD, in cruise flight near the Ukrainian/Russian 
border at 33,000 feet, under the control of Ukrainian Air Traffic Control and was 
operated by a competent and qualified crew. 

At 13.20:03 hours (15.20:03 CET) a warhead detonated outside and above the left 
hand side of the cockpit of flight MH17. It was a 9N314M warhead carried on the 
9M38-series of missiles as installed on the Buk surface-to-air missile system. 
Other scenarios that could have led to the disintegration of the aeroplane were 
considered, analysed and excluded based on the evidence available. 

The impact killed the three persons in the cockpit and caused structural damage 
to the forward part of the aeroplane leading to an in-flight break-up. The break-up 
resulted in a wreckage area of 50 square kilometres between the village of 
Petropavlivka and the town of Hrabove, Ukraine. All 298 occupants lost their lives. 


2. Conclusions regarding the flight route of MH17 


a. 





The aviation parties involved did not adequately recognise the risks of the armed 
conflict in the eastern part of Ukraine to overflying civil aviation. 


- During the period prior to the crash of flight MH17, the armed conflict in the 
eastern part of Ukraine expanded into the airspace. Consequently, the risks to 
overflying civil aviation increased. 


- The statements made by the Ukrainian authorities in which they reported that 


military aeroplanes had been shot down on 14 and 16 July, and in which they 
mentioned weapon systems that were able to reach cruising altitude of civil 
aeroplanes, provided sufficient reason for closing the airspace above the 
eastern part of Ukraine as a precaution. 


- The other parties involved - operators, the states in which they are based and 


third parties such as ICAO - did not identify potential risks posed by the armed 
conflict in the eastern part of Ukraine to civil aviation. Operators, including 
Malaysia Airlines, assumed that the open parts of Ukrainian airspace were safe. 
States did not issue any specific warnings about risks to civil aviation during 
the period in which the conflict expanded into the airspace. ICAO did not see 
any reason for questioning Ukraine or offer assistance. 
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. Conclusions regarding flying over conflict zones 


a. The current system of responsibilities for safeguarding civil aviation does not 
provide sufficient means to adequately assess the risks associated with flying over 
conflict areas. 

b. Risk assessment for civil aviation using the airspace over conflict areas should not 
only consider actual threats but should also include risks of which the intention or 
capability is uncertain. 


10.2 Supporting conclusions (causes of the crash) 


The cause that the Dutch Safety Board has identified is supported by the following 


findings. 


1. 


net 


Moment of the in-flight break-up 
The establishment of the moment of the in-flight break-up of the aeroplane is 
supported by the following findings: 


a. The Cockpit Voice Recorder and Flight Data Recorder stopped abruptly at 
13.20:03 (15.20:03 CET) because the power supply was interrupted. 

b. The fixed Emergency Locator Transmitter activated automatically within two 
seconds of the Cockpit Voice Recorder and Flight Data Recorder ceasing to record. 

c. The raw secondary surveillance radar data from the Ukrainian air navigation 
service provider and the radar screen video replay of the combined primary and 
secondary radar data from the Russian Federation’s air navigation service provider 
showed that flight MH17 was in straight and level flight at FL330 until 13.20:03 
(15.20:03 CET). 

d. The raw secondary surveillance data from the Ukrainian air navigation service 
provider showed that flight MH17 was not transmitting any secondary surveillance 
data from 13.20:03 (15.20:03 CET) onwards. 

e. The Russian Federation's air navigation service provider radar screen video replay 
of the combined primary and secondary radar data showed target tracks trom the 
aeroplane from 13.20:03 (15.20:03 CET) onward which were the result of coasting 
and of falling debris. 


. Sound peak 


The Cockpit Voice Recorder recorded a 2.3 millisecond sound peak. Signal 
triangulation showed that the noise originated trom outside the aeroplane, starting 
from a position above the left hand side of the cockpit, propagating from front to aft. 


. No other aeroplanes 


There was no evidence of other aircraft, civil or military, in the direct vicinity of flight 
MH17. According to radar data three other aeroplanes were in Sector 4 of 
Dnipropetrovsk Area Control Centre at the time of the crash, all commercial air 
transport category aeroplanes. Two were flying eastbound, one was flying westbound. 
All were under control of Dnipro Radar. At 13.20 (15.20 CET) the distance between 
the closest of these aeroplanes and flight MH17 was 33 km. 
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. Cockpit damage and crew injuries 

The damage observed on the forward fuselage and cockpit area of the aeroplane 
and the injuries of the flight crew and the cabin crew member in the cockpit indicated 
that there were multiple impacts from a large number of fragments from a point 
outside and above the left hand side of the cockpit. The pattern of damage observed 
to the forward fuselage and cockpit area of the aeroplane was not consistent with the 
damage that would be expected from any known failure mode of the aeroplane, its 
engines or systems. 


Fragments from one location 

The aeroplane was struck by a large number of small fragments with different shapes 
and sizes (cubic and in the form of a bow-tie) moving at high velocity. The direction of 
both the perforating and the non-perforating fragments originated from a single 
location outside left and above the cockpit. The fragments caused damage to the left 
hand side of the cockpit, the left engine intake ring and the left wing tip. 


Fragmentation spray of pre-formed fragments 

The objects that hit the aeroplane trom the outside with high energy, as found in the 
aeroplane wreckage and the bodies of the crew in the cockpit, were made of 
unalloyed steel. Some of these showed evidence of having passed through the 
aeroplane’s exterior surface and/or cockpit windows. The objects found were 
consistent with pre-formed fragments. The location, shape and boundaries of the 
damage to the wreckage of flight MH17, the number and density of hits on the 
wreckage and the objects found with different shapes and sizes were consistent with 
a fragmentation spray pattern damage of pre-formed fragments in the 9N314M 
warhead carried on the 9M38-series of missiles as installed on the Buk surface-to-air 
missile system. 


Missile parts 

A number of larger objects found on the ground and a few fragments found in the 
aeroplane’s wreckage were suspected to belong to a missile. Paint samples taken 
from these suspected missile parts found in the wreckage area match those found on 
foreign objects extracted from the aeroplane. The missile parts also had traces of a 
type of explosive (i.e. RDX) on them that is similar to the traces found on the wreckage. 


Blast 

Simulation of the blast after detonation of the 9N314M warhead revealed a shock 
wave near the cockpit. The simulation showed that the blast would cause structural 
damage to the aeroplane up to 12.5 metres from the point of detonation. This was 
consistent with the damage found on the aeroplane wreckage. 
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9. 


Failure sequence 
After the initial impact, the aeroplane broke up as follows: 


a. There was an almost instantaneous separation of the cockpit from the forward 
part of the fuselage when the pre-formed fragments penetrated the cockpit. The 
cockpit came to rest 2.3 kilometres from the last position recorded on the Flight 
Data Recorder. 

b. The aeroplane without its forward section continued flying along an undetermined 
flight path tor about 8.5 kilometres to the east before breaking up further. The 
centre section travelled further than the rear part of the fuselage. This centre 
section came to rest upside down. Parts of the wreckage caught fire. 

c. The time between the start of the break-up and the impact with the ground could 
not be accurately determined, but the centre and rear parts of the aeroplane were 
estimated to have taken about 1-1.5 minutes to reach the ground. Other, lighter 
parts, will have taken longer. 


10.Weapon used 


11. 


The aeroplane was struck by a 9N314M warhead as carried on a 9M38-series missile 
and launched by a Buk surface-to-air missile system. This conclusion is based on the 
combination of the following; the recorded sound peak, the damage pattern found 
on the wreckage caused by the blast and the impact of fragments, the bow-tie and 
cubic shaped fragments found in the cockpit and in the bodies of the crew members 
in the cockpit, the injuries sustained by three crew members in the cockpit, the 
analysis of the in-flight break-up, the analysis of the explosive residues and paint 
found and the size and distinct, bow-tie, shape of some of the fragments. 


Missile flight paths 

The area from which the possible flight paths of a 9N314M warhead carried on a 
9M38-series missile as installed on the Buk surface-to-air missile system could have 
commenced measures about 320 square kilometres in the east of Ukraine. Further 
forensic research is required to determine the launch location. Such work falls outside 
the mandate of the Dutch Safety Board, both in terms of Annex 13 and the Kingdom 
Act ‘Dutch Safety Board’. 


10.3 Excluding other causes of the crash 


The Dutch Safety Board has investigated and analysed a number of different possible 
causes of the crash. The Safety Board excluded the following issues as being factors in 
the crash of flight MH17. 


1. 





ap 





Flight crew 

The flight crew members were properly licensed and qualified to conduct the flight. 
There is no evidence that the crew handled the aeroplane inappropriately or their 
flying skills being affected by alcohol, drugs or medicine. 
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. Air traffic controller 


Licenses and qualifications of the air traffic controllers were not relevant to the 
investigation into the crash. The handling of the flight and the actions after radio 
contact with flight MH17 was lost, were considered adequate. 


. Airworthiness and flight plan 

The aeroplane was in an airworthy condition on departure from Amsterdam Airport 
Schiphol. There were no known technical malfunctions that could affect the safety of 
the flight. An air traffic control flight plan had been filed and the flight crew had been 
provided with an operational flight plan, NOTAMs, loading and weather information. 


. Loading and cargo 

The mass and centre of gravity of the aeroplane were within authorised limits. There 
was no cargo classified as dangerous goods on board the aeroplane, nor was any 
evidence found of explosion of dangerous goods inside the aeroplane. 


. Airspace 

On 17 July 2014, airspace restrictions were in place for the eastern part of Ukraine 
and parts of the bordering airspace in the Russian Federation from ground level up to 
FL320. There were no restrictions for flight MH17 to fly in Dnipropetrovsk Flight 
Information Region planned at flight levels FL330 and FL350. 


. Climb 


The flight crew's decision not to accept the air traffic controller’s request to climb 
from FL330 to FL350 was determined to be a normal operational consideration. 
Flying at either of these two flight levels had no influence on the ability of the surface- 
to-air missile to engage the aeroplane. 


. Weather 


The weather on the planned flight route showed the presence of thunderstorms 
moving north from the Black Sea. On request by the flight crew, the air traffic 
controller authorised flight MH17 to circumnavigate this weather. Flight MH17 did not 
deviate from the centreline of airway L980 by more than approximately 6.5 NM. In the 
last recorded position at 13.20:03 (15.20:03 CET), flight MH17 was within 5 NM of the 
centreline of airway L980. The weather had no influence on the crash to MH17. 


. Pre-existing damage 

There was no indication of a presence of pre-existing airframe damage, including 
fatigue or corrosion or inadequately performed repairs. There was no indication of 
engine failure. 


. No warnings 

Analysis of the Cockpit Voice Recorder and Flight Data Recorder confirmed the 
normal functioning of the aeroplane’s engines and systems prior to the crash. No 
warnings, failures or discrepancies were found in the data for the accident flight. No 
aural alerts or warnings of aeroplane system malfunctions were heard on the Cockpit 
Voice Recorder. The communication between the flight crew members gave no 
indication of any malfunction or emergency prior to the occurrence. 
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10.Other weapons 


a. Aijr-to-air gunfire 
The high-energy object damage was not caused by an air-to-air gun or cannon 
because the number of the perforations was not consistent with gunfire, and 
because air-to-air gun/cannon fire does not produce fragments with the distinctive 
forms that were found in the wreckage and in the bodies of three of the crew 
members in the cockpit. 

b. Aijir-to-air missile 
None of the air-to-air missiles in use in the region have the distinctly formed 
bow-tie shaped fragments in their warhead. 

c. The aeroplane was not struck by more than one weapon considering the wreckage 
distribution, the damage patterns and the fact that only once source of damage 
was found. 


11. Other scenarios 
Other possible scenarios that could have led to the disintegration of the aeroplane 
were considered and analysed. These scenarios were an on-board fire or a fuel tank 
explosion, the detonation of an explosive device inside the aeroplane, lightning strike, 
and impact by a meteor or space debris re-entering the atmosphere. All of them 
were excluded based on the available evidence. 


10.4 Other findings related to the crash 


1. Oxygen 
The emergency oxygen masks in the passenger cabin fell out of their overhead 
storage containers and the chemical oxygen generators were activated as the result 
of the in-flight break-up or ground impact. It is unlikely that the oxygen masks were 
deployed before the power supply was interrupted. 


2. Survival aspects (cockpit occupants) 
Hundreds of metal fragments were found in the bodies of the two pilots and the 
purser present in the cockpit at the time of the crash. These originated in part from 
the missile. The location in the bodies where the missile particles were found and the 
force with which they had penetrated them caused the three people in the cockpit to 
die instantly after the impact of the missile particles. 


3. Survival aspects (other occupants) 


a. There were no pre-formed fragments found in the bodies of the other occupants. 
As a result of the impact, they were exposed to extreme and many different, 
interacting factors: abrupt deceleration and acceleration, decompression and 
associated mist formation, decrease in oxygen level, extreme cold, strong airflow, 
the aeroplane’s very rapid descent and objects flying around. 

b. As a result, some occupants suffered serious injuries that were probably fatal. In 
others, the exposure led to reduced awareness or unconsiousness within a very 
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short time. It was not possible to ascertain at which moment the occupants died. 
The impact on the ground was not survivable. 

The Dutch Safety Board did not find any indications of conscious actions performed 
by the occupants after the missile’s detonation. It is likely that the occupants were 
barely able to comprehend the situation in which they found themselves. 


4. Recovery and transport of human remains 
In light of the circumstances, the recovery and transport of the human remains was 


carried out with the utmost care. 


5. Retention of ATC data 
The Russian Federation did not comply in all respects with the ICAO standard 
contained in paragraph 6.4.1 of Annex 11. 


10.5 Supporting conclusions (MH17 flight route) 


1. Signals to civil aviation 


ap 





The aeronautical information from the U.S. aviation authority, FAA, (FDC NOTAM 
4/3635) valid from 4 until 31 March 2014, warned U.S. operators and airmen about 
the unstable situation and the increasing military activity in the entire airspace of 
Ukraine. 

Between the end of April and 17 July 2014, the armed conflict in the eastern part 
of Ukraine expanded into the airspace. According to reports by the Ukrainian 
authorities, at least 16 Ukrainian armed forces’ helicopters and aeroplanes, 
including fighter aeroplanes, were shot down during this period. 

During the period in which the conflict in the eastern part of Ukraine expanded 
into the airspace, neither Ukraine nor other states or international organisations 
issued any specific security warnings to civil aviation about the airspace above the 
eastern part of Ukraine. 


. The Russian NOTAM about the Rostov FIR, which became effective on 17 July and 


applied to Russian Federation airspace, made a precise reference to the conflict in 
the eastern part of Ukraine as a reason for restricting a few parts of the Russian 
airsoace. This NOTAM was internally contradictory in terms of flying altitude. 

On 14 July 2014, the Ukrainian authorities reported publicly and in a closed 
briefing with Western diplomats that an Antonov An-26 military transport 
aeroplane had been shot down from an altitude of between 6,200 and 
6,500 metres. The weapon systems mentioned by the authorities in their 
statements are capable of reaching the cruising altitude of civil aeroplanes and 
would thus constitute a risk to civil aviation. 

On 17 July 2014, the Ukrainian authorities reported that a Sukhoi Su-25 had been 
shot down over the eastern part of Ukraine on 16 July; in their opinion most 
probably by an air-to-air missile fired trom the Russian Federation. The weapon 
systems mentioned by the authorities in their statements are capable of reaching 
the cruising altitude of civil aeroplanes. The Ukrainian authorities initially reported 
that the aeroplane had been flying at an altitude of 8,250 metres when it was hit. 
This altitude was later adjusted to 6,250 metres. 
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2. Ukraine's airspace management 


a. The decision-making processes related to the use of Ukraine's airspace was 


dominated by the interests of military aviation. The initiative to restrict the airspace 
over the eastern part of Ukraine below FL260 originated from the military 
authorities. The objective of the measure was to protect military aeroplanes trom 
attacks from the ground and to separate military air traffic from civil aviation. The 
Ukrainian authorities assumed that by taking this measure, civil aeroplanes flying 
over the area above FL260 were automatically safe too. 

The initiative to change the restriction to FL320 on 14 July 2014 came from civil air 
traffic control. The underlying reason for this change remains unclear. 

The NOTAMs did not contain any substantive reason for the altitude restrictions. 
Therefore, Ukraine did not act in accordance with the guidelines in ICAO Doc 
9554-AN/932. 


. When implementing the above measures, the Ukrainian authorities took insufficient 


notice of the possibility of a civil aeroplane at cruising altitude being fired upon. 
This was also the case, when, according to the Ukrainian authorities, the shooting- 
down of an Antonov An-26 on 14 July 2014 and that of a Sukhoi Su-25 on 16 July 
2014 occurred while these aeroplanes were flying at altitudes beyond the effective 
range of MANPADS. The weapon systems mentioned by the Ukrainian authorities 
in relation to the shooting down of these aircraft can pose a risk to civil aeroplanes, 
because they are capable of reaching their cruising altitude. However, no measures 
were taken to protect civil aeroplanes against these weapon systems. 


3. Operators 


ap 





Malaysia Airlines 

As operating carrier, Malaysia Airlines was responsible for the safe operation of 
flight MH17 and therefore for the choice of the flight route on 17 July 2014. The 
way in which Malaysia Airlines prepared and operated the flight complied with the 
applicable regulations. Malaysia Airlines relied on aeronautical information and 
did not perform any additional risk assessment. Malaysia Airlines did not receive 
signals from other operators or via any other channels indicating that the airspace 
above the eastern part of Ukraine was unsafe. 

Codeshare partnership 

Malaysia Airlines was also responsible for the safety of the passengers that had 
booked via its code share partner KLM. Since KLM, just like other operators, saw 
no safety reason to avoid the airspace above the eastern part of Ukraine, Malaysia 
Airlines and KLM did not exchange any information about the armed conflict. 
Other operators 


- A single operator decided to stop flying over Ukraine because of growing 
unrest in the country. This decision was made in March 2014, i.e. before the 
armed conflict broke out in the eastern part of Ukraine. 

- Insofar as the Dutch Safety Board was able to ascertain, no other operators 
changed their flight routes for safety reasons related to the conflict in the 
eastern part of Ukraine after this. This did not change after the Antonov An-26 
had been shot down on 14 July 2014, which, according to the Ukrainian 
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authorities had been done using a more powerful weapon system than 
MANPADS. 

- Data provided by EUROCONTROL reveal that during the period between 14 
up to and including 17 July, 61 operators from 32 states used the airspace 
above the eastern part of Ukraine. On 17 July 2014, 160 flights were guided 
through UKDV until the airspace was closed at 15.00 (17.00 CET). 

- Operators -including Malaysia Aijrlines- assumed that the unrestricted 
airsoace above FL320 over the eastern part of Ukraine was safe. This was 
despite the fact that the conflict was expanding into the air and that, according 
to the Ukrainian authorities, weapon systems were being used that could reach 
civil aeroplanes at cruising altitude. 


. Other states 


When, between the end of April and July, the armed conflict in the eastern part of 
Ukraine expanded into the airspace, not a single state, for as far as the Dutch Safety 
Board was able to ascertain, explicitly warned its operators and pilots that the 
airspace above the conflict zone was increasingly unsafe, nor did they issue a flight 
prohibition. States that did gather information about the conflict in the eastern part 
of Ukraine were focussing on military-strategic and geopolitical developments. 
Possible risks to civil aviation went unidentified. 


. ICAO 


During the period in which the conflict in the eastern part of Ukraine expanded into 
the airspace, ICAO did not ask the Ukrainian authorities about airsoace management 
and did not offer any assistance. This did not change after the statement made by the 
Ukrainian authorities on 14 July 2014 on the Antonov An-26 that had been shot down. 


. The Netherlands, the state of departure 

As state of departure of flight MH17, the Netherlands bore no responsibility for issuing 
Malaysia Airlines, an operator based abroad, with recommendations or indications 
about flying over the eastern part of Ukraine, or tor prohibiting it from using the 
airspace. 


. The Netherlands 


The Netherlands did not have authority based on Dutch legislation to impose a flight 
prohibition on operators under their control from flying in foreign airspace. 


. Information available to the Dutch services 


Prior to the crash of flight MH17 on 17 July, the Dutch intelligence and security 
services did not have any information about an actual threat to civil aviation using the 
airspace above the eastern part of Ukraine. 
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10.6 Supporting conclusions (flying over conflict zones) 
1. Airspace management 


a. In the international system of responsibilities, the sovereign state bears sole 
responsibility for the safety of the airspace. The fundamental principle of 
sovereignty can give rise to vulnerability when states are faced with armed 
conflicts on their territory and in their airspace. 

b. Such states rarely close their airsoace or provide aeronautical information with 
specific information or warnings about the conflict. In some cases, other states 
issue restrictions or prohibit their operators and pilots from using the airspace 
above these conflict areas. 

c. There is a lack of effective incentives to encourage sovereign states faced with 
armed conflicts to assume their responsibility for the safety of the airspace. 

d. Given the vulnerability of states facing an armed conflict, operators and other 
aviation parties cannot take it for granted that the airspace above the conflict 
zone is safe. They should perform their own risk assessment of the risks involved 
in overflying conflict areas. 

e. Whenever states (can) have access to information that is relevant to that risk 
assessment, they should share this information with operators in a structured 
manner. States that collect information about conflict areas could take account of 
airspace usage patterns for civil aviation. 


2. Risk assessment 
Existing threat analyses only consider a threat to be actual if both capability and 
intention have been established with sufficient certainty. Even if there is no certainty 
with regard to these factors, an armed conflict may still pose risks to civil aviation. In 
the current practice of risk assessment, these risks are too soon considered unlikely. 


3. Risk-increasing factors 


The identification and the use of risk-increasing factors are important for obtaining a 
better understanding of the likelihood of scenarios in an armed conflict. 
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Passengers travelling by air should be able to rely on the operator of their choice to have 
done all that is possible to operate the flight safely and that states have ensured that the 
airspace used for their flight is sate. When selecting flight routes operators should in turn 
be able to rely on states restricting or closing their airspace if it is unsafe for civil aviation. 
Airlines should also be able to assume that states that have or have access to information 
about risks and threats in foreign airspace ensure that this information, if required, results 
in advice or warnings on the use of that airspace. 


However, in practice this system does not yet work as it should. This investigation reveals 
that the current structure and functioning of the system of civil aviation responsibilities 
does not always lead to an adequate assessment of the risks associated with flying over 
conflict zones. Given the system weaknesses found, the Dutch Safety Board finds the 
system to be in urgent need of improvement. This applies to regulations, the way in 
which responsibilities are allocated and fulfilled, and the collaboration between parties. 


In the opinion of the Dutch Safety Board it is therefore necessary to implement 
improvements on three related levels. The first level concerns the management of the 
airspace in states dealing with an armed conflict in their territory. The second level 
concerns the manner in which states and operators assess the risks of flying over conflict 
zones. The third level concerns the accountability of operators regarding their choice of 
whether or not to fly over conflict zones. 


More attention to the first two levels would lead to an improvement in safety and, in the 
opinion of the Dutch Safety Board, reduces the likelihood of a crash like that of flight 
MH17 occurring again. Attention to the third level should lead to transparency in the 
processes airlines use when choosing flight routes, which could lead to a better risk 
assessment. 


In order to realise improvements on these three levels, initiatives will need to be taken in 
both a national and an international context. The Dutch Safety Board calls on states and 
the international organisations involved to make as great an effort as possible to 
contribute to these improvements. 


Level 1: Airspace management in conflict zones 


The principle of sovereignty forms the basis of the Chicago Convention. This principle 
implies that each state is responsible for its own airspace and determines independently 
how and by whom that airspace is used. The safety of the airspace is included in this 
responsibility of states. However, when a state contends with an armed conflict in its 
territory, this state may experience difficulty in guaranteeing the safety of its airspace. 
The Dutch Safety Board therefore deems it important that sovereign states in such 
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situations should be given more incentives and support in fulfilling this responsibility. On 
the one hand, the Dutch Safety Board is thinking of a stricter redefinition of the 
responsibility of states for their airspace and, on the other hand, a stronger, more pro- 
active role for the International Civil Aviation Organization, ICAO. The second 
consideration also requires States to take a more active role towards ICAO. 


In this respect, the following topics require attention: 


e The timely closure or restriction of the use of the airspace; 

e Providing information to third parties as quickly as possible in the event of an armed 
conflict with possible risks for civil aviation; 

e Such coordination between civil and military air navigation service providers during 
an armed conflict that the state can fulfil its responsibility for the satety of civil aviation 
in the airspace. 


This requires amendments to the Chicago Convention and in Standards and 
Recommended Practices. To this end, the Dutch Safety Board makes the following 
recommendations. 


To ICAO: 


1. Incorporate in Standards that states dealing with an armed conflict in their territory 
shall at an early stage publish information that is as specific as possible regarding the 
nature and extent of threats of that conflict and its consequences for civil aviation. 
Provide clear definitions of relevant terms, such as conflict zone and armed conflict. 


2. Ask states dealing with an armed conflict for additional information if published 
aeronautical or other publications give cause to do so; offer assistance and consider 
issuing a State Letter if, in the opinion of ICAO, states do not sufficiently fulfil their 
responsibility for the satety of the airspace for civil aviation. 


3. Update Standards and Recommended Practices related to the consequences of 
armed conflicts for civil aviation, and convert the relevant Recommended Practices 
into Standards as much as possible so that States will be able to take unambiguous 
measures if the safety of civil aviation may be at issue. 


To ICAO Member States: 
4. Ensure that States’ responsibilities related to the safety of their airspace are stricter 
defined in the Chicago Convention and the underlying Standards and Recommended 


Practices, so that it is clear in which cases the airspace should be closed. 


The states most closely involved in the investigation into the crash of flight MH17 
could initiate this. 


264 of 279 















Part A: 
2 Factual 
information 


Part B: 
Introduction to 
Part B 


Part B: 
5 The situation 


Part B: 
7 Flying over 
Ukraine 


Part B: 
9 Assessing the 
aL « 


11 


Recommendations 


16 
List of appendices 


Level 2: Risk assessment 


The investigation revealed that operators cannot take it for granted that an open airspace 
above a conflict zone is safe. This means that operators, in the light of their responsibility 
for a sate flight operation, should carry out their own risk assessment, not only for the 
countries of their destinations but also for the countries which they overfly. States are 
expected to contribute to this risk assessment by sharing relevant information about the 
conflict. 


Provision of information 

Improving the airlines’ access to information is first of all a matter tor the operators 
themselves. They should have to gather information about conflict zones more actively 
and share relevant threat information with one another as much as possible. If states have 
relevant threat information regarding the airspace it should be shared with operators and 
other interested parties through a timely and structured process. The safety of 
passengers, crews and aeroplanes can be improved if states make this information 
available to all operators and not only to the operators under their control. 


On the subject of availability of threat information, the Dutch Safety Board makes the 
following recommendation: 


To ICAO and IATA: 


5. Encourage states and operators who have relevant information about threats within a 
foreign airspace to make this available in a timely manner to others who have an 
interest in it in connection with aviation safety. Ensure that the relevant paragraphs in 
the ICAO Annexes concerned are extended and made more strict. 


Risk assessment 

The assessment of risks can be improved if a role is also assigned to the unpredictability 
of an armed conflict and to risk-increasing factors for civil aviation. With regard to the 
assessment of threat information, the Dutch Safety Board makes the following 
recommendations. 


To ICAO: 


6. Amend relevant Standards so that risk assessments shall also cover threats to civil 
aviation in the airspace at cruising level, especially when overtlying conflict zones. 
Risk increasing and uncertain factors need to be included in these risk assessments in 
accordance with the proposals made by the ICAO Working Group on Threat and 
Risk. 


To IATA: 


7. Ensure that the Standards regarding risk assessment are also reflected in the IATA 
Operational Safety Audits (IOSA). 
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To states (State of Operator): 


8. Ensure that operators are required through national regulations to make risk 
assessments of overflying conflict zones. Risk increasing and uncertain factors need 
to be included in these assessments in accordance with the proposals made by the 
ICAO Working Group on Threat and Risk. 


To ICAO and IATA: 


9. In addition to actions already taken, such as the website (ICAO Conflict Zone 
Information Repository) with notifications about conflict zones, a platform for 
exchanging experiences and good practices regarding assessing the risks related to 
the overflying of conflict zones is to be initiated. 


Level 3: Operator accountability 


It is not clear which flights pass over which conflict zones. Ideally, operators should have 
to actively provide information about routes to be flown and routes recently flown, so 
that everyone can form a judgement, thereby increasing public attention for this issue. A 
first step towards this would be to require operators to provide public accountability on 
a regular basis for routes over conflict zones selected by them. On the basis of this, the 
Dutch Safety Board makes the following recommendations: 


To IATA: 

10. Ensure that IATA member airlines agree on how to publish clear information to 
potential passengers about flight routes over conflict zones and on making operators 
accountable for that information. 


To operators: 


11. Provide public accountability for flight routes chosen, at least once a year. 
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Abbreviations 


AAIB 


AAPA 
ACARS 
ACI 
AIC 
AIP 
AIVD 


AMSL 
ANSP 


AOC 
APU 
ASCPC 
ATC 
ATL 
AIM 
ATSB 


AWACS 


BC 


CoA 

“ 

CAM 
CANSO 
CAVOK 
CET 

cm 
CML 


CRCO 


CTIVD 





Air Accidents Investigation Branch (Investigation organisation, United 
Kingdom) 

Association of Asia Pacific Airlines 

Aircraft Communications Addressing and Reporting System 

Airports Council International 

Aeronautical Information Circular 

Aeronautical Information Publication 

General Intelligence and Security Service, Netherlands (Algemene 
Inlichtingen- en Veiligheidsdienst) 

above mean sea level (feet) 

Air Navigation Service Provider (also known as Air Traffic Service 
Provider) 

Air Operator's Certificate 

auxiliary power unit 

air supply cabin pressure controllers 

Air Traffic Control 

Aeroplane Technical Log 

Air Traffic Management 

Australian Transport Safety Bureau (Investigation organisation, 
Australia) 

Airborne Warning and Control System 


Ballistic Coefficient 


Certificate of Airworthiness 

degrees Celsius 

cockpit area microphone 

Civil Air Navigation Services Organisation 

Ceiling and Visibility OK 

Central European (Summer) Time (local (summertime) in the Netherlands) 
centimetre(s) 

Centre for Man and Aviation in the Netherlands (Centrum voor Mens 
en Luchtvaart) 

Central Route Charges Office - EUROCONTROL body responsible for 
invoicing, collecting and distributing the fees for using flight routes 
Intelligence and Security Services Inspectorate, Netherlands (Commissie 
van Toezicht betreffende de Inlichtingen- en Veiligheidsdiensten) 
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CVR 


DCA 
Defat 
DfT 
DOF 
DSB 


EASA 

ECAC 

EDX 

EHAM 

ELT 
EUVROCONTROL 


FAA 
FATA 
FDC 
FDR 
FIB 
FIR 
FL 
FRG 
tt 


g 
GKOVD 


GND 
GPS 


HCSS 
HP 
hPa 


IAC 
IATA 
ICAO 
icee 


IFALPA 
IFATCA 
lIOSA 


JTAC 


kg 





¥f 


Cockpit Voice Recorder 


Department of Civil Aviation Malaysia 

Defence attaché 

Department for Transport, United Kingdom 

direction of flight 

Dutch Safety Board (Onderzoeksraad voor Veiligheid, Investigation 
organisation, the Netherlands) 


European Aviation Safety Agency 

European Civil Aviation Conference 

energy dispersive X-ray analysis 

ICAO code for Amsterdam Airport Schiphol, the Netherlands 
Emergency Locator Transmitter 

European organisation for the safety of air navigation 


Federal Aviation Administration, United States of America 
Federal Air Transport Agency, Russian Federation (Rosaviatsia) 
Flight Data Center 

Flight Data Recorder 

Focused lon Beam 

Flight Information Region 

flight level 

Federal Republic of Germany 

foot or feet 


force due to acceleration 

State Air Traftic Management Corporation, Russian Federation 
ground level 

Global Positioning System 


The Hague Centre for Strategic Studies 
high pressure 
hectopascal(s) 


Interstate Aviation Committee 

International Air Transport Association 

International Civil Aviation Organization 

Interdepartmental Crisis Management Committee, Netherlands 
(Interdepartementale Commissie Crisisbeheersing) 

International Federation of Air Line Pilot’s Associations 

International Federation of Air Traffic Controllers Associations 

IATA Operational Safety Audit 


Joint Terrorism Analysis Centre 


kilogramme(s) 
kilometre(s) 
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km/h 
KNMI 


kPa 


LTFO 


m 
MANPADS 
MAS 
MCCb 


METAR 
MH 
MIVD 


m/s 


NATO 
NBAAI 


NCTV 


NFI 
NLR 


NM 
NOTAM 
NOTOC 
NTSB 


O, 
OCC 
OSCE 


psI 
POU 


QAR 


RNBO 
RNLAF 


SAM 
SARPs 


net 


kilometres per hour 

Royal Netherlands Meteorological Institute (Koninklijk Nederlands 
Meteorologisch Instituut) 

kilopascal(s) 


National Forensic Investigations Team, the Netherlands (Landelijk 
Team Forensische Opsporing) 


metre(s) 

Man-portable air-defence system 

Malaysia Airlines System Berhad 

Ministerial Crisis Management Committee, Netherlands (Ministeriéle 
Commissie Crisisbeheersing) 

Meteorological Aerodrome Report 

IATA code for Malaysia Airlines 

Military Intelligence and Security Service, Netherlands (Militaire 
Inlichtingen- en Veiligheidsdienst) 

millisecond (one thousandth of a second = 0.001 second) 

metre(s) per second 


North Atlantic Treaty Organisation 

National Bureau of Air Accidents Investigation of Ukraine (Investigation 
organisation, Ukraine) 

National Coordinator for Security and Counterterrorism, Netherlands 
(Nationaal Coordinator Terrorismebestrijding en Veiligheid) 
Netherlands Forensic Institute (Nederlands Forensisch Instituut) 
National Aerospace Laboratory, the Netherlands (Nationaal Lucht- en 
Ruimtevaartlaboratorium) 

Nautical Mile 

Notice to Airmen 

Notice to Captain 

National Transportation Safety Board (Investigation organisation, 
United States of America) 


oxygen 
Operations Control Centre 


Organisation for Security and Cooperation in Europe 


pounds per square inch 
passenger service unit 


Quick Access Recorder 


National Security and Defence Council, Ukraine 
Royal Netherlands Air Force (Koninklijke Luchtmacht) 


Surface-to-Air Missile 
Standards and Recommended Practices (ICAO) 
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SASU 
SATCOM 
SIB 

SES 
SFAR 
OFrG 
SIGMET 
SSFDR 
SSP 

STA 


TF RCZ 
TNO 


TNT 
TC 


UKBB 
UKDD 
UKDR 
UKDV 
UKHH 
UkSATSE 
UNL 
UTC 


VHF 


WGTR 
WMKP 
WMMK 
WMSA 


Definitions 


State Aviation Service of Ukraine 

Satellite Communication 

Safety Information Bulletin 

State Emergency Service, Ukraine 

Special Federal Aviation Regulation (issued by the FAA) 
surface 

significant meteorological information 

Solid State Flight Data Recorder 

State Safety Program 

Station 


ICAO Task Force on Risks to Civil Aviation arising from Conflict Zones 
Netherlands Organisation for Applied Scientific Research (Nederlandse 
Organisatie voor toegepast natuurwetenschappelijk onderzoek) 
trinitrotoluene 

Time of useful consciousness 


ICAO code for Kyiv Borispil airport, Ukraine 

ICAO code for Dnipropetrovsk airport, Ukraine 

ICAO code for Kryvyi Righ airport, Ukraine 

ICAO code for Dnipropetrovsk Flight Information Region, Ukraine 
ICAO code for Kharkiv airport, Ukraine 

Ukrainian State Air Traffic Service Enterprise 

unlimited 

Coordinated Universal Time 


Very High Frequency 


ICAO Aviation Security Panel Working Group on Threat and Risk 
ICAO code for Penang Airport, Malaysia 

ICAO code for Kuala Lumpur International Airport, Malaysia 
ICAO code for Sultan Abdul Aziz Shah/Subang Airport, Malaysia 


Aeronautical Information Circular 
A notice containing information that does not qualify for the origination of a NOTAM or 


for inclusion in the AIP, but which relates to flight safety, air navigation, technical, 


administrative or legislative matters. 


Aeronautical Information Publication 
A publication issued by or with the authority of a State and containing aeronautical 


information of a lasting character essential to air navigation. 


Aircraft Communications Addressing and Reporting System (ACARS) 
This is a communication system used to transmit and receive messages between ground 


facilities (operator, maintenance department, aircraft or system manufacturer, etc.) and 


net 
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aircraft. For the purpose of the investigation it is not only the content of the messages 
that is of interest but the messages themselves may be considered as a confirmation of 
the functioning of the communication system. ACARS messages may be transmitted on 
either very high trequency radio or satellite communication (GSATCOM) frequencies. 


Airway 

An area or portion thereof established in the form of a corridor equipped with radio 
navigation aids. Some airways have specitic vertical and lateral dimensions whilst others 
are defined by an airway centreline and a minimum navigational accuracy of that an 
aircraft should adhere to for 95% of the time. In the case of the airway in the east of 
Ukraine that flight MH17 was on, the minimum navigational accuracy was 5 NM left or 
right of the centreline. 


Air traffic control flight plan 

Specific information, provided to units of air traffic services, regarding an intended flight 
or part of a flight such as the airport of departure and arrival, the intended route, the 
desired altitude(s) or flight level(s) on this route, type and registration of aircraft etc. 


Annex 

In this report, the word ‘Annex’ is used to refer to one of the 19 ICAO Annexes. An Annex 
includes international standards and recommended practices (Standards and 
Recommended Practices) such as those related to aviation safety and aviation security. 
Member States adhere to the standards and incorporate them in their national legislation 
unless they file a difference with regard to a standard to ICAO. 


Boeing 777 
In this report, the subject aeroplane was a series-200 model of the Boeing 777 aeroplane 
type. The terms Boeing 777 and 777 are synonymous. 


Broken (meteorological term) 
Cloud cover that obscures between five-eighths and seven-eighths of the sky. 


Coasting 

A ‘coasting’ mode is one for which the radar returns have been temporarily interrupted 
and position and altitude are being predicted and displayed based on the previously 
received radar data and flight plan information. The phenomenon is comparable to the 
manner in which a car’s navigation system continues to display vehicle movement when 
in a tunnel, without being able to receive a signal. 


Cockpit Voice Recorder 

A recorder used to record the audio environment of the cockpit of an aeroplane; 
including, general sounds, communications between crew members and with controllers 
on the ground. In the case of flight MH17, the Cockpit Voice Recorder installed is a solid 
state digital recorder. 


Conflict zone 


Area in which different parties are engaged in an armed conflict. 
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Coordinated Universal Time 

An international system that allows the comparison of local time to a reference time at 
the prime meridian 0 degrees longitude. At the time of the crash, the Netherlands was at 
UTC +2 (Central European (Summer) Time or CET) and Ukraine was at UTC +3. Unless 
otherwise indicated, all times in this report are in a 24-hour format and are reported in 
UTC followed by Central European (Summer) Time in brackets. 


Cruising altitude or level 
An altitude of flight level that is maintained for a considerable duration of the flight; in 
this report, it refers to the cruising altitude of jet engine propelled passenger aeroplanes. 


CT scan 
CT stands for computed tomography. By means of CT, three-dimensional X-ray images 
of the body can be made. 


Cycles 
The number of cycles can be counted in one of two ways: 


e the number of flights (take-off to landing) made by an aeroplane; 
e the number of times a system operates; i.e. is started and then stopped. 


Decompression 
Loss of (artificially maintained) air pressure and thus the oxygen supply in the cabin of an 
aeroplane. 


Defence attaché 
Military official linked to one or more embassies responsible for mapping out 
developments (including military developments) abroad. 


Dutch roll 
A type of aircraft motion that consists of an out-of-phase combination of yaw and roll. 


Emergency Locator Transmitter 
A radio beacon that interfaces with services offered by the International COSPAS-SARSAT 
Programme for search and rescue tracking. 


Flight Data Recorder 

A recorder used to record the input and output parameters of an aeroplane during flight. 
In the case of flight MH17, the Flight Data Recorder installed is a solid state digital 
recorder. 


Flight Information Region 


Airspace of defined dimensions within which flight information service and alerting 
service are provided. 
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Flight level or FL 

A surface of constant atmospheric pressure which is related to a specific pressure datum, 
1013.25 hectopascals (hPa), and is separated from other such surfaces by specific 
pressure intervals. FL330 is approximately equal to 33,000 feet or 10,058 metres above 
mean sea level. 


foot 
Unit of altitude above the ground 1 foot = 0.3048 m. 


Hazard 
Any source of potential damage, harm or adverse health effects on something or 
someone. 


hectopascal 
The international standard of measurement of atmospheric pressure. 


High-energy objects 

In this report, the term ‘high-energy object’ is used frequently in the singular and the 
plural. In the context of the investigation, the term is used to mean those small objects 
that were found not to belong to the aeroplane, its equipment or anything loaded 
on-board. These objects were found to have originated from outside the aeroplane and 
they struck the aeroplane’s structure at high soeed. Some of the parts travelled with a 
speed that was high enough for them to be coated with traces of molten cockpit glass 
and/or aluminium. Details on the exact number, shape, size and origin of the objects are 
addressed in the report. 


ICAO 

The International Civil Aviation Organization (ICAO) is a specialised agency of the United 
Nations. This intergovernmental organisation was founded in 1947 on the basis of the 
Convention on International Civil Aviation (Chicago Convention). The aims and objectives 
of ICAO are to develop the principles and techniques of international air navigation and 
to foster the planning and development of international air transport so as to, among 
other things, ensure the safe and orderly growth of international civil aviation throughout 
the world. The Chicago Convention is primarily applicable to civil aircraft. |CAO currently 
has 191 Member States, including Ukraine, Malaysia and the Netherlands. 


Interstate Aviation Committee (IAC) 

The Interstate Aviation Committee (MAK in Cyrillic text) was formed on the basis of an 
intergovernmental agreement signed in 1991. The following states are members of the 
IAC: Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russian Federation, 
Tajikistan, Turkmenistan, Ukraine and Uzbekistan. 


knot 
Unit of soeed used in aviation whereby one knot equals one nautical mile per hour or 
1,852 metres per hour. 
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Load sheet 
A document prepared before flight providing information on the aircraft’s mass, fuel 
load, passenger and cargo masses and the position of the aircraft’s centre of gravity. 


MANPADS 
Portable, shoulder-launched surface-to-air missile known as man-portable air-defence 
system. 


Mode S$ 
The term used for secondary surveillance radar and the data it transmits/receives. 


NOTAM 

A notice distributed by means of telecommunication containing information concerning 
the establishment, condition or change in any aeronautical facility, service, procedure or 
hazard, the timely knowledge of which is essential to personnel concerned with flight 
operations. 


NOTOC 
A document issued to the flight crew and used by ground handling organisations to 
communicate the details of any dangerous goods or special loads that have been loaded. 


Passenger doors 

The Boeing 777-200 aeroplane has eight passenger doors, four on each side. These are 
referenced in the text by a number (1 to 4) moving from the forward door rearwards and 
a letter, ‘U or ‘R’ for left or right. For example, the forward left-side passenger door is 
referenced as ‘door 1L in the report. 


Passenger service unit 
The part in the cabin above the passenger seats which contains among others things 
reading lamps, ventilation holes of the air conditioning and the oxygen masks. 


Pressure wave 
Wave of hot air caused by an explosion, also known as ‘blast’. 


Pressurised cabin 
Section of the aeroplane fuselage where the air pressure and the temperature are 
regulated so that passengers are not exposed to the ambient conditions at high altitude. 
In addition to the passenger section, the cockpit and cargo area are also found in the 
pressurised cabin. 


Risk 
The chance of an undesirable occurrence. 


Safety 
The state in which risks associated with aviation activities, related to, or in direct support 
of the operation of aircraft, are reduced and controlled to an acceptable level. 
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Section 

When referencing the location of structural parts, Boeing has sub-divided the fuselage 
into seven sections, see Figure 90. These are numbered from the forward to the rear 
sections as sections 41 and 43, to 48 inclusive. 


Section 41 43 44 46 47 
45 . 


Station 
(STA) 100 655 1035 1434 1832 2150 2570 





Figure 90: Schematic diagram of Boeing 777 Sections and Stations. (Source: Dutch Safety Board) 


Security 
Safeguarding civil aviation against acts of unlawful interference. This objective is achieved 
by a combination of measures and human and material resources. 


Solenoid 

A solenoid is a type of electromagnet that is used to generate a controlled magnetic 
field. The locks holding the passenger oxygen masks in passenger service units above 
the passenger seats are controlled by such an electromagnet. 


State 

In the context of this report, ‘state’ refers to a nation and its administrative responsibilities. 
When written with a capital ’s’, the text refers to responsibilities of a state following the 
Chicago Convention, such as State of Operator, State of Occurrence, etc. 


State aircraft 
The official ICAO name for aircraft used by military, customs and police services. 


Station 

A means of referencing the location of a part or object by means of its distance, in inches, 
from a datum ahead of the aeroplane’s nose, see Figure 90. This is abbreviated in the 
report to ‘STA’ followed by a number, e.g. Frame station 655 is referred to as STA655. 


Stringer 
A structural element of the aeroplane that provides rigidity to the aeroplane. In the case 
of the fuselage, these act along the longitudinal axis of the aeroplane. 


Target 
In this report, the word ‘target’ is used both to describe the plots on a radar display that 
are derived from signals from a radar station or in the military sense of the word. 
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Threat 
The intent and/or potential of persons or organisations to inflict harm. 


Underwater Locator Beacon 
Transmitting device that is attached to the aeroplane’s Cockpit Voice Recorder and/or 
Flight Data Recorder, and that is activated by water submersion. 


Conventions 
A number of writing conventions are used in this report: 


e Aeroplane vs. Aircraft: in this report, the word ‘aeroplane’ is used to refer to fixed- 
wing aircraft such as the Boeing 777 or similar. ‘Aircraft’ means ‘flying vehicles’ in 
general and includes both aeroplanes, helicopters and other vehicles. 

e Latitude and Longitude: locations are given in the WGS84-system, unless other 
specified. The usual notation, in degrees, minutes and seconds is dd° mm’ ss’N/ddd°® arses ~~ 
mm’ ss‘E. Seconds may be given to two or three decimal places, if required, for very laa) 
detailed placement of positions. In some cases, the original data from the Flight Data 
Recorder, in decimal form is also used. 

e Numbers: the following convention is used; n,nnn,nnn.nn 

e Place Names: for Ukrainian place names, Anglicised Ukrainian (e.g. Kharkiv, Kyiv, etc.) 


is used. Anglicised Russian is used for place names in the Russian Federation. ith 
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The following documents are appendices to the two parts: 


PART A: CAUSES OF THE CRASH 


ZEZErnAer-rammmooanwp 


. Investigation ativities and participants 


Reference information 


. Air Traffic Control flight plan 
. NOTAM information 


Load information 
Weather chart and weather satellite image 


. ATC Transcript 
. Recorded data 


Radar screen images 

Aeroplane systems and engines information 
Ballistic trajectory analysis methods 

Typical fracture modes 


. Agreement regarding Ukrainian ATC Data 
. Background to occupants exposure 


PART B: FLYING OVER CONFLICT ZONES 


a WA DO 


. Participants in the investigation 


Developments relevant to the investigation 


. Laws and regulations 


Operators that flew over the eastern part of Ukraine 

Precedents: Incidents involving Civil Aviation over conflict zones 

Report of the Dutch Review Committee for the Intelligence and Security Services 
(CTIVD) 

Flying over conflict areas - risk assessment 


APPENDICES AVAILABLE VIA THE WEBSITE WWW.SAFETYBOARD.NL 


V. 


Consultation Part A: Causes of the crash 


W. Consultation Part B: Flying over conflict zones 


X. 


Y. 





NLR report: Investigation of the impact damage due to high-energy objects on 
the wreckage of flight MH17 

TNO report: Damage reconstruction caused by impact of high-energetic particles 
on Malaysia Airlines flight MH17 
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Z. TNO report: Numerical simulation of blast loading on Malaysia Airlines flight MH17 
due to a warhead detonation 


Appendices X, Y and Z are reports produced at the request of the Dutch Safety Board by 
third parties. It should be noted that the Dutch Safety Board is not responsible for the 
content of the documents. In the event of differences between the content of the reports 
produced by third parties and the report of the Dutch Safety Board, the Board’s opinion 
is the one contained in its report. 
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